diff --git a/Jenkinsfile b/Jenkinsfile
index 7a631cc1a..437574bb9 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -81,14 +81,14 @@ spec:
       }
     }
     // Verifies that the -javadoc and -sources artifacts can be generated (by enabling the
-    // javadoc profile contained in three pom.xml files). Also verifies that the build
+    // prepare-release profile contained in four pom.xml files). Also verifies that the build
     // is reproducible, and that Spotbugs checks do not fail (cf.
     // https://eclipse.github.io/steady/contributor/#contribution-content-guidelines).
-    stage('Create javadoc + sources, Verify Spotbugs and Reproducibility') {
+    stage('Create javadoc + sources + CycloneDX BOM, Verify Spotbugs and Reproducibility') {
       steps {
         container('maven') {
           sh 'export MAVEN_OPTS="-Xms4g -Xmx8g"'
-          sh 'mvn -B -e -P gradle,javadoc \
+          sh 'mvn -B -e -P gradle,prepare-release \
                   -Dspring.standalone \
                   -DskipTests \
                   -Dvulas.shared.m2Dir=/home/jenkins/agent/workspace \
@@ -96,7 +96,7 @@ spec:
                   -Dspotbugs.includeFilterFile=findbugs-include.xml \
                   -Dspotbugs.failOnError=true \
                   clean install com.github.spotbugs:spotbugs-maven-plugin:4.2.3:check'
-          // sh 'mvn -B -e -P javadoc \
+          // sh 'mvn -B -e -P prepare-release \
           //         -Dspring.standalone \
           //         -DskipTests \
           //         -Dreference.repo=https://repo.maven.apache.org/maven2 \
@@ -132,7 +132,7 @@ spec:
             sh 'gpg --batch --import "${KEYRING}"'
             sh 'for fpr in $(gpg --list-keys --with-colons  | awk -F: \'/fpr:/ {print $10}\' | sort -u); do echo -e "5\ny\n" |  gpg --batch --command-fd 0 --expert --edit-key ${fpr} trust; done'
           }
-          sh 'mvn -B -e -P gradle,javadoc,release \
+          sh 'mvn -B -e -P gradle,prepare-release,release \
                   -Dspring.standalone \
                   -DskipTests \
                   clean deploy'
diff --git a/docker/.env.sample b/docker/.env.sample
index c6f025118..ed79b2124 100644
--- a/docker/.env.sample
+++ b/docker/.env.sample
@@ -34,9 +34,7 @@ https_proxy=
 no_proxy=
 
 # kb-importer update cron expression
-KB_IMPORTER_CRON_HOUR=0
 KB_IMPORTER_STATEMENTS_FOLDER=statements
 KB_IMPORTER_STATEMENTS_REPO=https://github.com/sap/project-kb
 KB_IMPORTER_STATEMENTS_BRANCH=vulnerability-data
 KB_IMPORTER_SKIP_CLONE=True
-KB_IMPORTER_CLONE_FOLDER=repo-clones
diff --git a/docker/cache/nginx.conf b/docker/cache/conf/nginx.conf
similarity index 100%
rename from docker/cache/nginx.conf
rename to docker/cache/conf/nginx.conf
diff --git a/docker/docker-compose-new.yml b/docker/docker-compose-new.yml
deleted file mode 100755
index 77810a8d8..000000000
--- a/docker/docker-compose-new.yml
+++ /dev/null
@@ -1,181 +0,0 @@
-version: '2.4'
-
-# This Docker Compose application makes use of profiles, available as of Docker
-# Compose 1.28.
-#
-# - Core services: haproxy, rest-backend and postgresql need to always run
-# - UI services: frontend-apps, frontend-bugs and cache deliver OpenUI5 Web
-#   applications for scan results (http://localhost:8033/apps) and
-#   vulnerabilities (http://localhost:8033/bugs).
-# - VDB services: rest-lib-utils, kb-importer and patch-lib-analyzer update
-#   the vulnerability database and resolve unassessed findings (by comparing
-#   method bodies obtained from rest-lib-utils)
-#
-# The different profiles can be started using start-steady.sh or using Docker
-# Compose's --profile option, e.g. docker-compose --profile ui up -d --build
-
-services:
-
-  # Core services
-  haproxy:
-    container_name: steady-haproxy
-    hostname: haproxy
-    env_file: .env
-    image: haproxy:2.3-alpine
-    ports:
-      - "8033:8080"
-      - "8034:7070"
-    volumes:
-      - "./conf/haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg"
-    command: ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
-    depends_on:
-      - rest-backend
-    security_opt:
-      - no-new-privileges
-    restart: always
-
-  rest-backend:
-    container_name: steady-rest-backend
-    hostname: rest-backend
-    env_file:
-      - .env
-      - ./conf/rest-backend/restbackend.properties
-    image: eclipse/steady-rest-backend:${VULAS_RELEASE}
-    expose:
-      - "8091"
-    environment:
-      - DELAY_STARTUP=5
-      - vulas.shared.cia.serviceUrl=http://rest-lib-utils:8092/cia
-      - vulas.shared.cve.serviceUrl=https://services.nvd.nist.gov/rest/json/cve/1.0/<ID>
-      - spring.datasource.username=${POSTGRES_USER}
-      - spring.datasource.password=${POSTGRES_PASSWORD}
-    volumes:
-      - "./data/rest-backend:/flyway-callbacks"
-    depends_on:
-      - postgresql
-    security_opt:
-      - no-new-privileges
-    restart: always
-
-  postgresql:
-    container_name: steady-postgresql
-    hostname: postgresql
-    image: postgres:11-alpine
-    environment:
-      - POSTGRES_DB=vulas
-      - POSTGRES_USER=${POSTGRES_USER}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
-      - PGDATA=/var/lib/postgresql/data
-    ports:
-      - "8032:5432"
-    volumes:
-      - steady-postgres-data:/var/lib/postgresql/data
-      - ./conf/postgresql:/docker-entrypoint-initdb.d:ro
-    security_opt:
-      - no-new-privileges
-    restart: always
-
-  # UI services
-  frontend-apps:
-    container_name: steady-frontend-apps
-    hostname: frontend-apps
-    image: eclipse/steady-frontend-apps:${VULAS_RELEASE}
-    expose:
-      - "8080"
-    depends_on:
-      - rest-backend
-      - cache
-    security_opt:
-      - no-new-privileges
-    restart: always
-    profiles:
-      - ui
-
-  frontend-bugs:
-    container_name: steady-frontend-bugs
-    hostname: frontend-bugs
-    image: eclipse/steady-frontend-bugs:${VULAS_RELEASE}
-    expose:
-      - "8080"
-    depends_on:
-      - rest-backend
-    security_opt:
-      - no-new-privileges
-    restart: always
-    profiles:
-      - ui
-
-  cache:
-    container_name: steady-cache
-    hostname: cache
-    image: nginx:alpine
-    expose:
-      - "80"
-    volumes:
-      - ./conf/cache/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./data/cache/:/tmp/cache_all/
-    security_opt:
-      - no-new-privileges
-    restart: always
-    profiles:
-      - ui
-
-  # VDB services
-  patch-lib-analyzer:
-    container_name: steady-patch-lib-analyzer
-    hostname: patch-lib-analyzer
-    image: eclipse/steady-patch-lib-analyzer:${VULAS_RELEASE}
-    expose:
-      - "8080"
-    volumes:
-      - "./data/patch-lib-analyzer:/patcheval-data"
-    depends_on:
-      - rest-backend
-      - rest-lib-utils
-    environment:
-      - PATCHEVAL_OPTS=-bug "" -folder /patcheval-data -j -h 0 -p 6
-      - vulas.shared.cia.serviceUrl=http://rest-lib-utils:8092/cia
-      - vulas.shared.backend.serviceUrl=http://rest-backend:8091/backend
-      - vulas.patchEval.onlyAddNewResults=true
-    security_opt:
-      - no-new-privileges
-    restart: always
-    profiles:
-      - vdb
-
-  rest-lib-utils:
-    container_name: steady-rest-lib-utils
-    hostname: rest-lib-utils
-    image: eclipse/steady-rest-lib-utils:${VULAS_RELEASE}
-    expose:
-        - "8092"
-    volumes:
-      - "./data/rest-lib-utils:/root/"
-    security_opt:
-      - no-new-privileges
-    restart: always
-    profiles:
-      - vdb
-
-  kb-importer:
-    container_name: steady-kb-importer
-    image: eclipse/steady-kb-importer:${VULAS_RELEASE}
-    env_file: .env
-    volumes:
-      - "./conf/kb-importer:/kb-importer/conf"
-      - "./certs:/kb-importer/certs"
-      - "./data/kb-importer:/kb-importer/data:delegated"
-    environment:
-      - CIA_SERVICE_URL=http://rest-lib-utils:8092/cia
-      - BACKEND_SERVICE_URL=http://rest-backend:8091/backend
-    depends_on:
-      - rest-backend
-      - rest-lib-utils
-    security_opt:
-      - no-new-privileges
-    restart: always
-    profiles:
-      - vdb
-
-volumes:
-  steady-postgres-data:
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 8296aa874..6e024b221 100755
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -1,26 +1,22 @@
 version: '2.4'
 
-services:
-  frontend-apps:
-    container_name: steady-frontend-apps
-    hostname: frontend-apps
-    image: eclipse/steady-frontend-apps:${VULAS_RELEASE}
-    expose:
-      - "8080"
-    security_opt:
-      - no-new-privileges
-    restart: always
+# This Docker Compose application makes use of profiles, available as of Docker
+# Compose 1.28.
+#
+# - Core services: haproxy, rest-backend and postgresql need to always run
+# - UI services: frontend-apps, frontend-bugs and cache deliver OpenUI5 Web
+#   applications for scan results (http://localhost:8033/apps) and
+#   vulnerabilities (http://localhost:8033/bugs).
+# - VDB services: rest-lib-utils, kb-importer and patch-lib-analyzer update
+#   the vulnerability database and resolve unassessed findings (by comparing
+#   method bodies obtained from rest-lib-utils)
+#
+# The different profiles can be started using start-steady.sh or using Docker
+# Compose's --profile option, e.g. docker-compose --profile ui up -d --build
 
-  frontend-bugs:
-    container_name: steady-frontend-bugs
-    hostname: frontend-bugs
-    image: eclipse/steady-frontend-bugs:${VULAS_RELEASE}
-    expose:
-      - "8080"
-    security_opt:
-      - no-new-privileges
-    restart: always
+services:
 
+  # Core services
   haproxy:
     container_name: steady-haproxy
     hostname: haproxy
@@ -33,32 +29,30 @@ services:
       - "./haproxy/conf/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg"
     command: ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
     depends_on:
-      - frontend-apps
-      - frontend-bugs
       - rest-backend
-      - rest-lib-utils
     security_opt:
       - no-new-privileges
     restart: always
 
-  patch-lib-analyzer:
-    container_name: steady-patch-lib-analyzer
-    hostname: patch-lib-analyzer
-    image: eclipse/steady-patch-lib-analyzer:${VULAS_RELEASE}
+  rest-backend:
+    container_name: steady-rest-backend
+    hostname: rest-backend
+    env_file:
+      - .env
+      - ./rest-backend/conf/restbackend.properties
+    image: eclipse/steady-rest-backend:${VULAS_RELEASE}
     expose:
-      - "8080"
+      - "8091"
+    environment:
+      - DELAY_STARTUP=5
+      - vulas.shared.cia.serviceUrl=http://rest-lib-utils:8092/cia
+      - vulas.shared.cve.serviceUrl=https://services.nvd.nist.gov/rest/json/cve/1.0/<ID>
+      - spring.datasource.username=${POSTGRES_USER}
+      - spring.datasource.password=${POSTGRES_PASSWORD}
     volumes:
-      - "./data/patcheval:/patcheval-data"
-    links:
-      - rest-backend:backend
-      - rest-lib-utils:cia
+      - "./rest-backend/data:/flyway-callbacks"
     depends_on:
-      - rest-backend
-    environment:
-      - PATCHEVAL_OPTS=-bug "" -folder /patcheval-data -j -h 0 -p 6
-      - vulas.shared.cia.serviceUrl=http://cia:8092/cia
-      - vulas.shared.backend.serviceUrl=http://backend:8091/backend
-      - vulas.patchEval.onlyAddNewResults=true
+      - postgresql
     security_opt:
       - no-new-privileges
     restart: always
@@ -76,48 +70,39 @@ services:
       - "8032:5432"
     volumes:
       - steady-postgres-data:/var/lib/postgresql/data
-      - ./postgresql/docker-entrypoint-initdb.d:/docker-entrypoint-initdb.d:ro
+      - ./postgresql/conf:/docker-entrypoint-initdb.d:ro
     security_opt:
       - no-new-privileges
     restart: always
 
-  rest-backend:
-    container_name: steady-rest-backend
-    hostname: rest-backend
-    env_file:
-      - .env
-      - ./rest-backend/conf/restbackend.properties
-    image: eclipse/steady-rest-backend:${VULAS_RELEASE}
+  # UI services
+  frontend-apps:
+    container_name: steady-frontend-apps
+    hostname: frontend-apps
+    image: eclipse/steady-frontend-apps:${VULAS_RELEASE}
     expose:
-      - "8091"
-    environment:
-      - DELAY_STARTUP=5
-      - vulas.shared.cia.serviceUrl=http://cia:8092/cia
-      - vulas.shared.cve.serviceUrl=https://services.nvd.nist.gov/rest/json/cve/1.0/<ID>
-      - spring.datasource.username=${POSTGRES_USER}
-      - spring.datasource.password=${POSTGRES_PASSWORD}
-    links:
-      - postgresql:postgresql
-      - rest-lib-utils:cia
-    volumes:
-      - "./data/db-dump/flyway-callbacks:/flyway-callbacks"
+      - "8080"
     depends_on:
-      - postgresql
+      - rest-backend
     security_opt:
       - no-new-privileges
     restart: always
+    profiles:
+      - ui
 
-  rest-lib-utils:
-    container_name: steady-rest-lib-utils
-    hostname: rest-lib-utils
-    image: eclipse/steady-rest-lib-utils:${VULAS_RELEASE}
+  frontend-bugs:
+    container_name: steady-frontend-bugs
+    hostname: frontend-bugs
+    image: eclipse/steady-frontend-bugs:${VULAS_RELEASE}
     expose:
-        - "8092"
-    volumes:
-      - "./data/rest-lib-utils:/root/"
+      - "8080"
+    depends_on:
+      - rest-backend
     security_opt:
       - no-new-privileges
     restart: always
+    profiles:
+      - ui
 
   cache:
     container_name: steady-cache
@@ -126,31 +111,72 @@ services:
     expose:
       - "80"
     volumes:
-      - ./cache/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./data/cache/:/tmp/cache_all/
+      - ./cache/conf/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./cache/data/:/tmp/cache_all/
+    security_opt:
+      - no-new-privileges
+    restart: always
+    profiles:
+      - ui
+
+  # VDB services
+  patch-lib-analyzer:
+    container_name: steady-patch-lib-analyzer
+    hostname: patch-lib-analyzer
+    image: eclipse/steady-patch-lib-analyzer:${VULAS_RELEASE}
+    expose:
+      - "8080"
+    volumes:
+      - "./patch-lib-analyzer/data:/patcheval-data"
+    depends_on:
+      - rest-backend
+      - rest-lib-utils
+    environment:
+      - PATCHEVAL_OPTS=-bug "" -folder /patcheval-data -j -h 0 -p 6
+      - vulas.shared.cia.serviceUrl=http://rest-lib-utils:8092/cia
+      - vulas.shared.backend.serviceUrl=http://rest-backend:8091/backend
+      - vulas.patchEval.onlyAddNewResults=true
     security_opt:
       - no-new-privileges
     restart: always
+    profiles:
+      - vdb
+
+  rest-lib-utils:
+    container_name: steady-rest-lib-utils
+    hostname: rest-lib-utils
+    image: eclipse/steady-rest-lib-utils:${VULAS_RELEASE}
+    expose:
+        - "8092"
+    volumes:
+      - "./rest-lib-utils/data:/root/"
+    security_opt:
+      - no-new-privileges
+    restart: always
+    profiles:
+      - vdb
 
   kb-importer:
     container_name: steady-kb-importer
     image: eclipse/steady-kb-importer:${VULAS_RELEASE}
+    expose:
+      - "8080"
     env_file: .env
     volumes:
       - "./kb-importer/conf:/kb-importer/conf"
-      - "./kb-importer/certs:/kb-importer/certs"
+      - "./certs:/kb-importer/certs"
       - "./kb-importer/data:/kb-importer/data:delegated"
     environment:
-      - CIA_SERVICE_URL=http://cia:8092/cia
-      - BACKEND_SERVICE_URL=http://backend:8091/backend
+      - CIA_SERVICE_URL=http://rest-lib-utils:8092/cia
+      - BACKEND_SERVICE_URL=http://rest-backend:8091/backend
     depends_on:
       - rest-backend
-    links:
-      - rest-backend:backend
-      - rest-lib-utils:cia
+      - rest-lib-utils
     security_opt:
       - no-new-privileges
     restart: always
+    profiles:
+      - vdb
 
 volumes:
   steady-postgres-data:
diff --git a/docker/frontend-apps/Dockerfile b/docker/frontend-apps/Dockerfile
index 453fb1eaf..af9bdc8a5 100644
--- a/docker/frontend-apps/Dockerfile
+++ b/docker/frontend-apps/Dockerfile
@@ -1,4 +1,5 @@
-FROM jetty:alpine
+# https://hub.docker.com/layers/jetty/library/jetty/9.4.46-jdk11-alpine-eclipse-temurin/images/sha256-dcaab143043b8916675f8533700c07310986e94db9ee4f2f6bf336e8befc53e9?context=explore
+FROM jetty@sha256:dcaab143043b8916675f8533700c07310986e94db9ee4f2f6bf336e8befc53e9
 
 LABEL maintainer="steady-dev@eclipse.org"
 
diff --git a/docker/frontend-bugs/Dockerfile b/docker/frontend-bugs/Dockerfile
index c99ab5f8d..90812fe0f 100644
--- a/docker/frontend-bugs/Dockerfile
+++ b/docker/frontend-bugs/Dockerfile
@@ -1,4 +1,5 @@
-FROM jetty:alpine
+# https://hub.docker.com/layers/jetty/library/jetty/9.4.46-jdk11-alpine-eclipse-temurin/images/sha256-dcaab143043b8916675f8533700c07310986e94db9ee4f2f6bf336e8befc53e9?context=explore
+FROM jetty@sha256:dcaab143043b8916675f8533700c07310986e94db9ee4f2f6bf336e8befc53e9
 
 LABEL maintainer="steady-dev@eclipse.org"
 
diff --git a/docker/haproxy/conf/haproxy.cfg b/docker/haproxy/conf/haproxy.cfg
index 014c282a1..d2ad98454 100644
--- a/docker/haproxy/conf/haproxy.cfg
+++ b/docker/haproxy/conf/haproxy.cfg
@@ -40,6 +40,7 @@ frontend http-in
     
     acl is_backend path_beg -i /backend
     acl is_cia path_beg -i /cia
+    acl is_kb_importer path_beg -i /kb-importer
     acl is_bugs_admin path_beg -i /bugs
     acl is_frontend path_beg -i /apps
     acl to_be_cached_long_term urlp_reg(lastChange) ^[0-9]{13}$
@@ -48,6 +49,7 @@ frontend http-in
     use_backend cache-long-term-nodes if to_be_cached_long_term cache_long_term_available
     use_backend rest-backend-nodes if is_backend
     use_backend rest-lib-utils-nodes if is_cia
+    use_backend kb-importer-nodes if is_kb_importer
     use_backend frontend-bugs-nodes if is_bugs_admin
     use_backend frontend-apps-nodes if is_frontend
 
@@ -72,6 +74,17 @@ backend rest-lib-utils-nodes
     stats enable
     server rest-lib-utils rest-lib-utils:8092 check resolvers docker_resolver resolve-prefer ipv4
 
+backend kb-importer-nodes
+    mode 	http
+    log 	global
+    balance 	roundrobin
+    option 	forwardfor
+    http-request set-header X-Forwarded-Port %[dst_port]
+    option httpchk GET /kb-importer/ HTTP/1.1\r\nHost:\ haproxy01
+    http-check expect ! rstatus ^5
+    stats enable
+    server kb-importer kb-importer:8080 check resolvers docker_resolver resolve-prefer ipv4
+
 backend rest-backend-nodes
     mode http
     log global
diff --git a/docker/kb-importer/Dockerfile b/docker/kb-importer/Dockerfile
index b3419954f..9fb78174b 100644
--- a/docker/kb-importer/Dockerfile
+++ b/docker/kb-importer/Dockerfile
@@ -1,4 +1,5 @@
-FROM openjdk:11-jre-slim
+# https://hub.docker.com/layers/eclipse-temurin/library/eclipse-temurin/11.0.15_10-jre/images/sha256-1543416e05e9fde8ffede76cd5f0955b640d7159bdbff8574eed6560a98e4ad3?context=explore
+FROM eclipse-temurin@sha256:1543416e05e9fde8ffede76cd5f0955b640d7159bdbff8574eed6560a98e4ad3
 
 LABEL maintainer="steady-dev@eclipse.org"
 
@@ -6,7 +7,7 @@ ARG VULAS_RELEASE
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
-        openssl wget tar git cron bash gettext\
+        openssl wget tar git cron bash gettext curl \
     && rm -rf /var/lib/apt/lists/* \
     && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
 
@@ -15,10 +16,12 @@ WORKDIR /kb-importer
 RUN wget https://github.com/SAP/project-kb/releases/download/v0.6.18/kaybee-0.6.18_linux-amd64 -O kaybee
 RUN chmod +x kaybee
 
-COPY kb-importer-$VULAS_RELEASE-jar-with-dependencies.jar kb-importer.jar
+COPY kb-importer-$VULAS_RELEASE.jar kb-importer.jar
 RUN chmod +x kb-importer.jar
 
-COPY kb-importer.sh start.sh /kb-importer/
-RUN chmod +x /kb-importer/kb-importer.sh /kb-importer/start.sh
+COPY run.sh /kb-importer/
+RUN chmod +x /kb-importer/run.sh
 
-ENTRYPOINT ["sh","/kb-importer/start.sh"]
+EXPOSE 8080
+
+ENTRYPOINT ["sh","/kb-importer/run.sh"]
diff --git a/docker/kb-importer/conf/kaybeeconf.yaml.sample b/docker/kb-importer/conf/kaybeeconf.yaml.sample
index 7613cc13b..7310ae5b6 100644
--- a/docker/kb-importer/conf/kaybeeconf.yaml.sample
+++ b/docker/kb-importer/conf/kaybeeconf.yaml.sample
@@ -29,202 +29,6 @@ export:
   #   each: |
   #     {{ if .Fixes }} {{ .VulnerabilityID}},{{ (index (index .Fixes 0).Commits 0).RepositoryURL }}{{end}}
   #   post:
-  - target: steady
-    filename: steady.sh
-    pre: |
-      #!/bin/bash
-
-      # ------------------------------------------------
-      #  Import script for Eclipse Steady
-      # ------------------------------------------------
-
-      ##-------- E D I T   T H I S  S E C T I O N --------
-      ##
-      ## COMMENT OUT THE NEXT LINE AND EDIT THE FOLLOWING LINES
-      #echo "Please configure the necessary variables in the script and try again" && exit 1
-
-      # Your user token (required to upload vulnerability data to Steady backend)
-      USER_TOKEN=$BACKEND_BUGS_TOKEN
-
-      # Backend URL of your Steady instance
-      BACKEND_URL=$BACKEND_SERVICE_URL
-
-      # URL of the CIA service of your Steady instance
-      CIA_URL=$CIA_SERVICE_URL
-
-      # This must be the absolute path to the kb-importer jar file
-      KB_IMPORTER_PATH="/kb-importer/data/kb-importer.jar"
-      
-      # Skip repos clone and thus vulnerabilities requiring it
-      SKIP_CLONE=$KB_IMPORTER_SKIP_CLONE
-      ##---------------------- E N D --------------------
-
-      ANALYZER_CMD="java -Dvulas.shared.backend.header.X-Vulas-Client-Token=$USER_TOKEN -Dvulas.shared.cia.serviceUrl=$CIA_URL -Dvulas.shared.backend.serviceUrl=$BACKEND_URL -jar $KB_IMPORTER_PATH  -u"
-      LOCAL_CLONES_DIR=$KB_IMPORTER_CLONE_FOLDER
-
-      folder_for_repo(){
-        X=$1
-
-        # remove trailing slash
-        X=${X%/}
-
-        # remove everything until '://' is matched
-        X=${X#*:\/\/}
-
-        # replace _ for .
-        X=${X//./_}
-
-        # replace _ for /
-        X=${X//\//_}
-        echo ${LOCAL_CLONES_DIR}/$X
-      }
-
-      clone_once(){
-        DIR=$(folder_for_repo $1)
-
-        if [ -d $DIR ];
-        then
-            echo "Folder $DIR exists, skipping git clone"
-        else
-            echo "Cloning $1 to folder $DIR"
-            git clone $1 $DIR
-        fi
-      }
-
-      #make_vuln_metadata(){
-      #  vulnerability_id="$1"
-      #  description="$2"
-      #  links="$3"
-      #
-      #  [ -d $vulnerability_id ] || mkdir ./$vulnerability_id
-      #  > $vulnerability_id/meta.properties
-      #  echo "vulnerability_id=$vulnerability_id" >> $vulnerability_id/meta.properties
-      #  echo "description=$description" >> $vulnerability_id/meta.properties
-      #  echo "links=$links" >> $vulnerability_id/meta.properties
-      #}
-
-      create_meta_from_tar(){
-        repo_url=$1
-        commit_id=$2
-        branch=$3
-        vulnerability_id=$4
-        source_path=$5
-
-        if [ -f $vulnerability_id/$commit_id/metadata.json ]
-        then
-          return
-        fi
-
-        [ -d $vulnerability_id/$commit_id ] || mkdir -p $vulnerability_id/$commit_id
-        if [ -f $source_path/changed-source-code.tar.gz ]
-        then
-          timestamp=`cat $vulnerability_id/$commit_id/timestamp`
-          echo "{" > $vulnerability_id/$commit_id/metadata.json
-          echo "  \"repository\" : \"$repo_url\"," >> $vulnerability_id/$commit_id/metadata.json
-          echo "  \"branch\" : \"$branch\"," >> $vulnerability_id/$commit_id/metadata.json
-          echo "  \"timestamp\" : \"$timestamp\"," >> $vulnerability_id/$commit_id/metadata.json
-          echo "  \"commit_id\" : \"$commit_id\"" >> $vulnerability_id/$commit_id/metadata.json
-          echo "}" >> $vulnerability_id/$commit_id/metadata.json
-          rm $vulnerability_id/$commit_id/timestamp
-        fi
-        return
-      }
-
-      clone_and_create_meta(){
-        repo_url=$1
-        commit_id=$2
-        branch=$3
-        vulnerability_id=$4
-        source_path=$5
-
-        if [ -f $vulnerability_id/$commit_id/metadata.json ]
-        then
-          return
-        fi
-
-        clone_once $repo_url
-        repo_dir=$(folder_for_repo $repo_url)
-
-        timestamp=$(git -C $repo_dir show --no-patch --no-notes --pretty='%at' $commit_id)
-
-        echo "{" > $vulnerability_id/$commit_id/metadata.json
-        echo "  \"repository\" : \"$repo_url\"," >> $vulnerability_id/$commit_id/metadata.json
-        echo "  \"branch\" : \"$branch\"," >> $vulnerability_id/$commit_id/metadata.json
-        echo "  \"timestamp\" : \"$timestamp\"," >> $vulnerability_id/$commit_id/metadata.json
-        echo "  \"commit_id\" : \"$commit_id\"" >> $vulnerability_id/$commit_id/metadata.json
-        echo "}" >> $vulnerability_id/$commit_id/metadata.json
-
-        echo "dir=$repo_dir"
-        echo "pwd=`pwd`"
-
-        # cd repository
-        for F in $(git -C $repo_dir diff  --name-only  $commit_id^..$commit_id);
-        do
-
-          echo "repo_dir=$repo_dir"
-          echo "pwd=`pwd`"
-
-          echo "Extracting file: $F"
-          [ -d $vulnerability_id/$commit_id/before/$(dirname $F) ] || mkdir -p $vulnerability_id/$commit_id/before/$(dirname $F)
-          [ -d $vulnerability_id/$commit_id/after/$(dirname $F) ] || mkdir -p $vulnerability_id/$commit_id/after/$(dirname $F)
-
-          if ( git -C $repo_dir cat-file -e $commit_id~1:$F &> /dev/null )
-          then
-            git -C $repo_dir show $commit_id~1:$F > $vulnerability_id/$commit_id/before/$F
-          fi
-
-          if ( git -C $repo_dir cat-file -e $commit_id:$F &> /dev/null )
-          then
-            git -C $repo_dir show $commit_id:$F > $vulnerability_id/$commit_id/after/$F
-          fi
-        done
-      }
-
-    each: |+
-      # -----------------------------------------------
-      #  Analyzing vulnerability {{ .VulnerabilityID}}
-      # -----------------------------------------------
-      {{ if .VulnerabilityID }}
-      [ -d ./{{ .VulnerabilityID }} ] || mkdir ./{{ .VulnerabilityID }}
-      {{ $source_path := .Metadata.LocalPath }}
-      [ -f {{ $source_path }}/changed-source-code.tar.gz ] && tar -xf {{ $source_path }}/changed-source-code.tar.gz -C ./{{ .VulnerabilityID }}
-      
-      cat << 'EOM' > ./{{ .VulnerabilityID }}/metadata.json
-      {{ .ToJSON }}
-      EOM
-      
-      if [ -f {{ $source_path }}/changed-source-code.tar.gz ] ;
-      then 
-       # Create the metadata from the tarball cloned previously
-      {{ if .Fixes}}{{ $description :=  or ((index .Notes 0).Text) "" }}
-      {{ $vuln := .VulnerabilityID}}{{ $repo := (index (index .Fixes 0).Commits 0).RepositoryURL }}
-      {{ range $f := .Fixes  }}{{ range .Commits }}create_meta_from_tar {{$repo}} {{.ID}} {{$f.ID}} {{ $vuln }} {{ $source_path }}
-      {{end}}{{end}}
-      {{end}}
-      $ANALYZER_CMD -d ./{{ .VulnerabilityID }}
-      : 
-      else     
-      if [ ! "${KB_IMPORTER_SKIP_CLONE}" == "True" ]; 
-      then 
-      # Create the metadata after cloning the repo of the affected package and checking out every commit
-      {{ if .Fixes}}{{ $description :=  or ((index .Notes 0).Text) "" }}
-      #make_vuln_metadata {{ .VulnerabilityID }} '{{ JoinNotes . }}' {{ LinksAsCSV . }}
-      {{ $vuln := .VulnerabilityID}}{{ $repo := (index (index .Fixes 0).Commits 0).RepositoryURL }}
-      {{ range $f := .Fixes  }}{{ range .Commits }}clone_and_create_meta {{$repo}} {{.ID}} {{$f.ID}} {{ $vuln }} {{ $source_path }}
-      {{end}}{{end}}
-      {{else}}
-      # This vulnerability has no fix-commits
-      :
-      {{end}}
-      $ANALYZER_CMD -d ./{{ .VulnerabilityID }}
-      fi
-      fi
-      {{end}}
-
-    post: |-
-      # ------------------------------------------------
-      # This script was generated with KayBee
-      # ------------------------------------------------
   - target: xml
     filename: vulnerabilities.xml
     pre:  |
@@ -251,4 +55,4 @@ export:
       </VulnerabilityID>
     post: |
       </Vulnerabilities>
-      </xml>
+      </xml>
\ No newline at end of file
diff --git a/docker/kb-importer/kb-importer.sh b/docker/kb-importer/kb-importer.sh
deleted file mode 100644
index f9fe7e1b9..000000000
--- a/docker/kb-importer/kb-importer.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/bin/bash
-
-construct_kaybee_pull_folder(){
-  X=$1
-
-  # remove trailing slash
-  X=${X%/}
-
-  # remove everything until '://' is matched
-  X=${X#*:\/\/}
-  
-  # Remove the longest matching suffix pattern
-  HOST=${X%%/*}
-  
-  # Remove shortest matching prefix pattern.
-  PATH=${X#*\/}
-
-  # replace . for /
-  PATH=${PATH//\//.}
-
-  echo ${HOST}_${PATH}
-}
-
-#if [ ! -f /kb-importer/data/running ]
-#then
-#  touch /kb-importer/data/running
-
-  #kaybee update
-  cd /kb-importer/data
-  ./kaybee update --force
-
-  #run kaybee import for kaybeeconf.yaml (as it contains the substituted env variables for the source repo and branch)
-  echo `date` " Running Kaybee Import" 
-  ./kaybee pull -c ../conf/kaybeeconf.yaml
-# As we cannot configure the destination folder of kaybee pull (for now), we explicitly copy the resulting folder to the configured one and skip kaybee merge as we only have 1 source configurable
-  cp -r .kaybee/repositories/$(construct_kaybee_pull_folder $KB_IMPORTER_STATEMENTS_REPO)_$KB_IMPORTER_STATEMENTS_BRANCH/statements/. $KB_IMPORTER_STATEMENTS_FOLDER/
-#  echo `date` " Running Kaybee Merge" >> job.log 2>&1
-#  ./kaybee merge -s -c ../conf/kaybeeconf.yaml
-#  echo `date` " Kaybee Merge Done" >> job.log 2>&1
-  ./kaybee export -t steady -c ../conf/kaybeeconf.yaml -f $KB_IMPORTER_STATEMENTS_FOLDER
-  chmod +x steady.sh
-  ./steady.sh 
-  echo `date` " Kaybee Import Done" 
-#  rm /kb-importer/data/running
-#else
-#  echo `date` " Kaybee Import already Running" 
-#fi
diff --git a/docker/kb-importer/run.sh b/docker/kb-importer/run.sh
new file mode 100644
index 000000000..397d5849d
--- /dev/null
+++ b/docker/kb-importer/run.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+# Home directory of kb-importer
+home="/kb-importer"
+
+mkdir -p $home/data
+
+echo "Statements repo:   " $KB_IMPORTER_STATEMENTS_REPO
+echo "Statements branch: " $KB_IMPORTER_STATEMENTS_BRANCH
+echo "Statements folder: " $KB_IMPORTER_STATEMENTS_FOLDER
+echo "Skip clones:       " $KB_IMPORTER_SKIP_CLONE
+
+# Substitute env variables used by kaybee in kaybeeconf.yaml
+sed    "s|KB_IMPORTER_STATEMENTS_REPO|$KB_IMPORTER_STATEMENTS_REPO|g"     $home/conf/kaybeeconf.yaml.sample > $home/conf/kaybeeconf.yaml
+sed -i "s|KB_IMPORTER_STATEMENTS_BRANCH|$KB_IMPORTER_STATEMENTS_BRANCH|g" $home/conf/kaybeeconf.yaml
+
+# Adding certs
+certs=`ls $home/certs | grep -v readme.txt`
+for cert in $certs; do
+   keytool -import -alias $cert -storepass changeit -keystore /usr/lib/jvm/java-1.8-openjdk/jre/lib/security/cacerts -file $home/certs/$cert -noprompt
+done
+
+java -Dvulas.shared.backend.header.X-Vulas-Client-Token=$BACKEND_BUGS_TOKEN \
+          -Dvulas.shared.cia.serviceUrl=$CIA_SERVICE_URL \
+          -Dvulas.shared.backend.serviceUrl=$BACKEND_SERVICE_URL \
+          -jar $home/kb-importer.jar | tee $home/data/analyzer_logs.txt
diff --git a/docker/kb-importer/start.sh b/docker/kb-importer/start.sh
deleted file mode 100644
index 775bc4b21..000000000
--- a/docker/kb-importer/start.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/bin/bash
-
-mkdir -p /kb-importer/data
-cd /kb-importer/data
-if [ -d $KB_IMPORTER_CLONE_FOLDER ] && [ ! -z $KB_IMPORTER_CLONE_FOLDER ]; then
-  mkdir -p $KB_IMPORTER_CLONE_FOLDER
-fi
-if [ -f /kb-importer/kb-importer.jar ]; then
-  mv /kb-importer/kb-importer.jar /kb-importer/kaybee /kb-importer/data
-fi
-
-#substitute env variables used by kaybee in kaybeeconf.yaml
-sed "s|KB_IMPORTER_STATEMENTS_REPO|$KB_IMPORTER_STATEMENTS_REPO|g" ../conf/kaybeeconf.yaml.sample > ../conf/kaybeeconf.yaml
-sed -i "s|KB_IMPORTER_STATEMENTS_BRANCH|$KB_IMPORTER_STATEMENTS_BRANCH|g" ../conf/kaybeeconf.yaml
-
-echo "Statements repo: " $KB_IMPORTER_STATEMENTS_REPO
-echo "Statements branch: " $KB_IMPORTER_STATEMENTS_BRANCH
-echo "Statements folder: " $KB_IMPORTER_STATEMENTS_FOLDER
-echo "Clones folder: " $KB_IMPORTER_CLONE_FOLDER
-echo "Skip clones: " $KB_IMPORTER_SKIP_CLONE
-
-./kaybee update --force
-
-#Adding certs
-certs=`ls /kb-importer/certs | grep -v readme.txt`
-for cert in $certs; do
-   keytool -import -alias $cert -storepass changeit -keystore /usr/lib/jvm/java-1.8-openjdk/jre/lib/security/cacerts -file /kb-importer/certs/$cert -noprompt
-done
-
-#Wait for backend to start
-sleep 40
-
-#Run initial import
-./../kb-importer.sh
-
-#create a cron job kaybeeconf.yaml
-crontab -l > tmpcron
-if ! cat tmpcron | grep "kb-importer.sh"
-then
-    if [ -z "$KB_IMPORTER_CRON_HOUR" ]	
-    then
-      echo "0 0 * * * PATH=$PATH BACKEND_SERVICE_URL=$BACKEND_SERVICE_URL KB_IMPORTER_STATEMENTS_FOLDER=$KB_IMPORTER_STATEMENTS_FOLDER KB_IMPORTER_STATEMENTS_BRANCH=$KB_IMPORTER_STATEMENTS_BRANCH KB_IMPORTER_STATEMENTS_REPO=$KB_IMPORTER_STATEMENTS_REPO KB_IMPORTER_CLONE_FOLDER=$KB_IMPORTER_CLONE_FOLDER KB_IMPORTER_SKIP_CLONE=$KB_IMPORTER_SKIP_CLONE /kb-importer/kb-importer.sh >> /kb-importer/cron.log 2>&1" >> tmpcron
-    else
-      echo "0 " "$KB_IMPORTER_CRON_HOUR" " * * * PATH=$PATH BACKEND_SERVICE_URL=$BACKEND_SERVICE_URL KB_IMPORTER_STATEMENTS_FOLDER=$KB_IMPORTER_STATEMENTS_FOLDER KB_IMPORTER_STATEMENTS_BRANCH=$KB_IMPORTER_STATEMENTS_BRANCH KB_IMPORTER_STATEMENTS_REPO=$KB_IMPORTER_STATEMENTS_REPO KB_IMPORTER_CLONE_FOLDER=$KB_IMPORTER_CLONE_FOLDER KB_IMPORTER_SKIP_CLONE=$KB_IMPORTER_SKIP_CLONE /kb-importer/kb-importer.sh  >> /kb-importer/cron.log 2>&1" >> tmpcron
-    fi
-fi
-crontab tmpcron
-echo "cron job created."
-rm tmpcron
-cron -f
diff --git a/docker/patch-lib-analyzer/Dockerfile b/docker/patch-lib-analyzer/Dockerfile
index b5198975d..911dd04f0 100644
--- a/docker/patch-lib-analyzer/Dockerfile
+++ b/docker/patch-lib-analyzer/Dockerfile
@@ -1,4 +1,5 @@
-FROM openjdk:11-jre-slim
+# https://hub.docker.com/layers/eclipse-temurin/library/eclipse-temurin/11.0.15_10-jre/images/sha256-1543416e05e9fde8ffede76cd5f0955b640d7159bdbff8574eed6560a98e4ad3?context=explore
+FROM eclipse-temurin@sha256:1543416e05e9fde8ffede76cd5f0955b640d7159bdbff8574eed6560a98e4ad3
 
 LABEL maintainer="steady-dev@eclipse.org"
 
@@ -10,9 +11,9 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/* \
     && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
 
-COPY patch-lib-analyzer-${VULAS_RELEASE}-jar-with-dependencies.jar /vulas/patch-lib-analyzer.jar
-COPY run.sh /vulas/run.sh
+COPY patch-lib-analyzer-${VULAS_RELEASE}-jar-with-dependencies.jar /steady/patch-lib-analyzer.jar
+COPY run.sh /steady/run.sh
 
-RUN chmod +x /vulas/run.sh
+RUN chmod +x /steady/run.sh
 
-CMD ["/vulas/run.sh"]
+CMD ["/steady/run.sh"]
diff --git a/docker/patch-lib-analyzer/run.sh b/docker/patch-lib-analyzer/run.sh
index d40cb4fca..015c61e77 100755
--- a/docker/patch-lib-analyzer/run.sh
+++ b/docker/patch-lib-analyzer/run.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-#Wait for backend to start and kb-importer to insert data
+# Wait for backend to start and kb-importer to insert data
 sleep 300
 
 java \
@@ -10,4 +10,4 @@ java \
 	-Dhttps.proxyHost=$HTTPS_PROXY_HOST \
 	-Dhttps.proxyPort=$HTTPS_PROXY_PORT \
     -Dspring.profiles.active=docker \
-	-jar /vulas/patch-lib-analyzer.jar $PATCHEVAL_OPTS
+	-jar /steady/patch-lib-analyzer.jar $PATCHEVAL_OPTS
diff --git a/docker/postgresql/docker-entrypoint-initdb.d/10-vulas-setup.sh b/docker/postgresql/conf/10-vulas-setup.sh
similarity index 100%
rename from docker/postgresql/docker-entrypoint-initdb.d/10-vulas-setup.sh
rename to docker/postgresql/conf/10-vulas-setup.sh
diff --git a/docker/rest-backend/Dockerfile b/docker/rest-backend/Dockerfile
index f1d2e1e9c..0405e4afd 100644
--- a/docker/rest-backend/Dockerfile
+++ b/docker/rest-backend/Dockerfile
@@ -1,4 +1,5 @@
-FROM openjdk:11-jre-slim
+# https://hub.docker.com/layers/eclipse-temurin/library/eclipse-temurin/11.0.15_10-jre/images/sha256-1543416e05e9fde8ffede76cd5f0955b640d7159bdbff8574eed6560a98e4ad3?context=explore
+FROM eclipse-temurin@sha256:1543416e05e9fde8ffede76cd5f0955b640d7159bdbff8574eed6560a98e4ad3
 
 LABEL maintainer="steady-dev@eclipse.org"
 
@@ -10,12 +11,12 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/* \
     && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
 
-COPY rest-backend-$VULAS_RELEASE.jar /vulas/rest-backend.jar
-COPY run.sh /vulas/run.sh
+COPY rest-backend-$VULAS_RELEASE.jar /steady/rest-backend.jar
+COPY run.sh /steady/run.sh
 RUN touch /$VULAS_RELEASE
 
 EXPOSE 8091
 
-RUN chmod +x /vulas/run.sh
+RUN chmod +x /steady/run.sh
 
-CMD ["/vulas/run.sh"]
+CMD ["/steady/run.sh"]
diff --git a/docker/rest-backend/run.sh b/docker/rest-backend/run.sh
index 0ba953a87..64a02b661 100755
--- a/docker/rest-backend/run.sh
+++ b/docker/rest-backend/run.sh
@@ -20,4 +20,4 @@ java \
     -Dvulas.jira.pwd=$JIRA_PASSWORD \
     $FLYWAY_OPTS \
     -Dspring.profiles.active=docker \
-	-jar /vulas/rest-backend.jar
+	-jar /steady/rest-backend.jar
diff --git a/docker/rest-lib-utils/Dockerfile b/docker/rest-lib-utils/Dockerfile
index e1401ffeb..ffaf9909e 100644
--- a/docker/rest-lib-utils/Dockerfile
+++ b/docker/rest-lib-utils/Dockerfile
@@ -1,12 +1,13 @@
-FROM openjdk:11-jre-slim
+# https://hub.docker.com/layers/eclipse-temurin/library/eclipse-temurin/11.0.15_10-jre/images/sha256-1543416e05e9fde8ffede76cd5f0955b640d7159bdbff8574eed6560a98e4ad3?context=explore
+FROM eclipse-temurin@sha256:1543416e05e9fde8ffede76cd5f0955b640d7159bdbff8574eed6560a98e4ad3
 
 LABEL maintainer="steady-dev@eclipse.org"
 
 ARG VULAS_RELEASE
 
-COPY rest-lib-utils-${VULAS_RELEASE}.jar /vulas/rest-lib-utils.jar
+COPY rest-lib-utils-${VULAS_RELEASE}.jar /steady/rest-lib-utils.jar
 RUN touch /$VULAS_RELEASE
 
 EXPOSE 8092
 
-CMD java -Dhttp.nonProxyHosts=${NON_PROXY_HOSTS} -Dhttps.nonProxyHosts=${NON_PROXY_HOSTS} -Dhttps.proxyHost=${HTTPS_PROXY_HOST} -Dhttps.proxyPort=${HTTP_PROXY_PORT} -Dhttp.proxyHost=${HTTP_PROXY_HOST} -Dhttp.proxyPort=${HTTP_PROXY_PORT} -jar /vulas/rest-lib-utils.jar
+CMD java -Dhttp.nonProxyHosts=${NON_PROXY_HOSTS} -Dhttps.nonProxyHosts=${NON_PROXY_HOSTS} -Dhttps.proxyHost=${HTTPS_PROXY_HOST} -Dhttps.proxyPort=${HTTP_PROXY_PORT} -Dhttp.proxyHost=${HTTP_PROXY_HOST} -Dhttp.proxyPort=${HTTP_PROXY_PORT} -jar /steady/rest-lib-utils.jar
diff --git a/docker/setup-steady.sh b/docker/setup-steady.sh
index c661f2e22..1fb7bf5f6 100755
--- a/docker/setup-steady.sh
+++ b/docker/setup-steady.sh
@@ -48,23 +48,23 @@ setup (){
     # Create directories
     #mkdir -p $DIR/certs
     for s in $conf_services; do
-        mkdir -p $DIR/conf/$s
+        mkdir -p $DIR/$s/conf
     done
     for s in $data_services; do
-        mkdir -p $DIR/data/$s
+        mkdir -p $DIR/$s/data
     done
 
     # Download all necessary files
-    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/docker-compose-new.yml -o ./$DIR/docker-compose.yml
-    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/.env.sample            -o ./$DIR/.env
-    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/start-steady.sh        -o ./$DIR/start-steady.sh
+    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/docker-compose.yml -o ./$DIR/docker-compose.yml
+    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/.env.sample        -o ./$DIR/.env
+    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/start-steady.sh    -o ./$DIR/start-steady.sh
     chmod 744 ./$DIR/start-steady.sh
 
-    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/haproxy/conf/haproxy.cfg                                -o ./$DIR/conf/haproxy/haproxy.cfg
-    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/postgresql/docker-entrypoint-initdb.d/10-vulas-setup.sh -o ./$DIR/conf/postgresql/10-vulas-setup.sh 
-    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/cache/nginx.conf                                        -o ./$DIR/conf/cache/nginx.conf
-    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/kb-importer/conf/kaybeeconf.yaml.sample                 -o ./$DIR/conf/kb-importer/kaybeeconf.yaml.sample
-    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/rest-backend/conf/restbackend.properties                -o ./$DIR/conf/rest-backend/restbackend.properties
+    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/haproxy/conf/haproxy.cfg                  -o ./$DIR/haproxy/conf/haproxy.cfg
+    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/postgresql/conf/10-vulas-setup.sh         -o ./$DIR/postgresql/conf/10-vulas-setup.sh 
+    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/cache/conf/nginx.conf                     -o ./$DIR/cache/conf/nginx.conf
+    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/kb-importer/conf/kaybeeconf.yaml.sample   -o ./$DIR/kb-importer/conf/kaybeeconf.yaml.sample
+    curl -s https://raw.githubusercontent.com/eclipse/steady/$TAG/docker/rest-backend/conf/restbackend.properties  -o ./$DIR/rest-backend/conf/restbackend.properties
 
     # Create default configuration in user's home directory
     home_config="$HOME/.steady.properties"
diff --git a/docker/start-steady.sh b/docker/start-steady.sh
index 0c23bdbc6..80f7769df 100755
--- a/docker/start-steady.sh
+++ b/docker/start-steady.sh
@@ -96,10 +96,18 @@ if [[ $rc == 0 ]]; then
     exit 1
 fi
 
+# If run from the cloned repo, the file docker-compose.build.yaml can be used to
+# create new Docker images for snapshot versions. When run after
+# steady-setup.sh, the images will be downloaded from Docker Hub.
+build=""
+if [[ -f docker-compose.build.yml ]]; then
+    build="-f docker-compose.build.yml"
+fi
+
 # Start different sets of services
 case $SERVICES in
     none)
-        docker-compose -f ./docker-compose.yml stop
+        docker-compose -f ./docker-compose.yml $build stop
         rc=$?
         if [[ $rc == 0 ]]; then
             printf "Stopped all of Steady's Docker Compose services\n"
@@ -111,7 +119,7 @@ case $SERVICES in
     core)
         stop_ui
         stop_vdb
-        docker-compose -f ./docker-compose.yml up -d --build
+        docker-compose -f ./docker-compose.yml $build up -d --build
         rc=$?
         if [[ $rc == 0 ]]; then
             printf "Started Steady's core Docker Compose services\n"
@@ -122,7 +130,7 @@ case $SERVICES in
         ;;
     ui)
         stop_vdb
-        docker-compose -f ./docker-compose.yml --profile ui up -d --build
+        docker-compose -f ./docker-compose.yml $build --profile ui up -d --build
         rc=$?
         if [[ $rc == 0 ]]; then
             printf "Started Steady's core and UI Docker Compose services\n"
@@ -133,7 +141,7 @@ case $SERVICES in
         ;;
     vdb)
         stop_ui
-        docker-compose -f ./docker-compose.yml --profile vdb up -d --build
+        docker-compose -f ./docker-compose.yml $build --profile vdb up -d --build
         rc=$?
         if [[ $rc == 0 ]]; then
             printf "Started Steady's core and vdb Docker Compose services\n"
@@ -143,7 +151,7 @@ case $SERVICES in
         fi
         ;;
     all)
-        docker-compose -f ./docker-compose.yml --profile ui --profile vdb up -d --build
+        docker-compose -f ./docker-compose.yml $build --profile ui --profile vdb up -d --build
         rc=$?
         if [[ $rc == 0 ]]; then
             printf "Started all of Steady's Docker Compose services\n"
diff --git a/docs/public/content/admin/tutorials/build.md b/docs/public/content/admin/tutorials/build.md
index dc864fdae..2c6a433fd 100644
--- a/docs/public/content/admin/tutorials/build.md
+++ b/docs/public/content/admin/tutorials/build.md
@@ -43,6 +43,8 @@ docker run -it --rm -v ${PWD}/docker:/exporter --env-file ./docker/.env -e mvn_f
 
 > In case you are running behind a proxy you need to configure it in the `--build-arg` arguments. Check the [predefined `ARG`s](https://docs.docker.com/engine/reference/builder/#predefined-args) documentation to know more.
 
+> In case you'd like to avoid downloading all dependencies by reusing your local Maven repository, add a volume as follows `-v "$HOME/.m2":/root/.m2`, see [here](https://hub.docker.com/_/maven/) for more information.
+
 As a result, the folders `docker/<component-name>` will contain compiled JARs (or WARs, depending on the component). The folder `docker/client-tools` will be populated with the JARs for client side tools (CLI, plugins, patchanalyzer).
 
 Additionally, you may want to make the artifacts available to the developers of your organization (e.g., through an internal Nexus or other artifact distribution system).
@@ -58,13 +60,18 @@ You are now ready to run the system with the generated archives and create the D
 You can create and run containers from the generated images.
 
 ```sh
-(cd docker && docker-compose -f docker-compose.yml -f docker-compose.build.yml up -d)
+(cd docker && docker-compose -f docker-compose.yml -f docker-compose.build.yml --profile vdb --profile ui up -d)
 ```
 
 To check everything started successfully, browse the page `http://localhost:8033/haproxy?stats`. All endpoints should appear as green.
 
 > `username` and `password` can be found in your `.env` file, be also advised that `rest-backend` could take more than 30 seconds to be ready to answer HTTP requests
 
+Run the following to stop all containers.
+
+```sh
+(cd docker && docker-compose -f docker-compose.yml -f docker-compose.build.yml --profile vdb --profile ui down)
+```
 ---
 
 Get going:
diff --git a/kb-importer/pom.xml b/kb-importer/pom.xml
old mode 100755
new mode 100644
index e4eacc46d..0b5243fc7
--- a/kb-importer/pom.xml
+++ b/kb-importer/pom.xml
@@ -1,48 +1,92 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-
     This file is part of Eclipse Steady.
-
     Licensed under the Apache License, Version 2.0 (the "License");
     you may not use this file except in compliance with the License.
     You may obtain a copy of the License at
-
         http://www.apache.org/licenses/LICENSE-2.0
-
     Unless required by applicable law or agreed to in writing, software
     distributed under the License is distributed on an "AS IS" BASIS,
     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     See the License for the specific language governing permissions and
     limitations under the License.
-
     SPDX-License-Identifier: Apache-2.0
     SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
-
 -->
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
+
 	<parent>
-		<artifactId>root</artifactId>
-		<groupId>org.eclipse.steady</groupId>
-		<version>3.2.5-SNAPSHOT</version>
+		<groupId>org.springframework.boot</groupId>
+		<artifactId>spring-boot-starter-parent</artifactId>
+		<version>2.6.3</version>
+		<relativePath/>
 	</parent>
 
+	<groupId>org.eclipse.steady</groupId>
 	<artifactId>kb-importer</artifactId>
+	<version>3.2.5-SNAPSHOT</version>
 
 	<name>Knowledge Base Importer</name>
-	<description></description>
+	<description>
+		Imports vulnerabilities from Project KB into Steady's database.
+	</description>
+
+	<properties>
+		<maven.compiler.release>8</maven.compiler.release>
+		<maven.compiler.showWarnings>true</maven.compiler.showWarnings>
+		<maven.compiler.showDeprecation>true</maven.compiler.showDeprecation>
+		<maven.compiler.skipMultiThreadWarning>true</maven.compiler.skipMultiThreadWarning>
+		
+		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+		
+		<!-- Skip install and deploy -->
+		<skip.install.deploy>true</skip.install.deploy>
+		<maven.install.skip>${skip.install.deploy}</maven.install.skip>
+		<maven.deploy.skip>${skip.install.deploy}</maven.deploy.skip>
+
+		<!-- Used by several plugins, to make builds reproducible -->
+		<project.build.outputTimestamp>2021-06-22T10:45:00Z</project.build.outputTimestamp>
+	</properties>
 
 	<dependencies>
+	    <dependency>
+      		<groupId>org.springframework.boot</groupId>
+    		<artifactId>spring-boot-starter-web</artifactId>
+    	</dependency>
+	
 		<dependency>
-			<groupId>commons-cli</groupId>
-			<artifactId>commons-cli</artifactId>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter</artifactId>
 		</dependency>
+
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-test</artifactId>
+			<scope>test</scope>
+		</dependency>
+
+		<!-- Swagger dependencies -->
+		<!-- <dependency>
+	      <groupId>org.springdoc</groupId>
+	      <artifactId>springdoc-openapi-ui</artifactId>
+	      <version>1.2.32</version>
+	   </dependency> -->
+
 		<dependency>
 			<groupId>commons-io</groupId>
 			<artifactId>commons-io</artifactId>
+			<version>2.11.0</version>
+		</dependency>
+
+		<dependency>
+			<groupId>org.yaml</groupId>
+			<artifactId>snakeyaml</artifactId>
+			<version>1.30</version>
 		</dependency>
+
 		<!-- Only basic lang classes should be used at compile time -->
 		<dependency>
 			<groupId>org.eclipse.steady</groupId>
@@ -50,6 +94,7 @@
 			<version>${project.version}</version>
 			<scope>compile</scope>
 		</dependency>
+
 		<!-- Test dependencies -->
 		<dependency>
 			<groupId>org.eclipse.steady</groupId>
@@ -58,6 +103,12 @@
 			<version>${project.version}</version>
 			<scope>test</scope>
 		</dependency>
+		<dependency>
+			<groupId>junit</groupId>
+			<artifactId>junit</artifactId>
+			<version>4.13.2</version>
+		</dependency>
+
 		<!-- Runtime dependencies, to avoid compile time dependency on lang-specific 
 			classes -->
 		<dependency>
@@ -72,92 +123,140 @@
 			<version>${project.version}</version>
 			<scope>runtime</scope>
 		</dependency>
-		<dependency>
-			<groupId>com.github.package-url</groupId>
-			<artifactId>packageurl-java</artifactId>
-		</dependency>
+		
 		<dependency>
 			<groupId>com.jayway.jsonpath</groupId>
 			<artifactId>json-path</artifactId>
 			<version>2.7.0</version>
 		</dependency>
+
 	</dependencies>
 
+	<profiles>
+		<!-- Activate when deploying to the Central Repo. Also see https://central.sonatype.org/pages/apache-maven.html#nexus-staging-maven-plugin-for-deployment-and-release -->
+		<profile>
+			<id>prepare-release</id>
+			<build>
+				<plugins>
+					<plugin>
+						<groupId>org.apache.maven.plugins</groupId>
+						<artifactId>maven-source-plugin</artifactId>
+						<version>3.2.0</version>
+						<executions>
+							<execution>
+								<id>attach-sources</id>
+								<goals>
+									<goal>jar-no-fork</goal>
+								</goals>
+							</execution>
+						</executions>
+					</plugin>
+					<!--  Run the following to fix all JavaDoc: "mvn -DdefaultAuthor=SAP -X -DfixTags=param,return,throws -DignoreClirr=true -P gradle clean compile org.apache.maven.plugins:maven-javadoc-plugin:3.3.0:fix"
+					The tag 'links' results in an exception in module lang-java.-->
+					<plugin>
+						<groupId>org.apache.maven.plugins</groupId>
+						<artifactId>maven-javadoc-plugin</artifactId>
+						<version>3.3.0</version>
+						<executions>
+							<execution>
+								<id>attach-javadocs</id>
+								<goals>
+									<goal>jar</goal>
+								</goals>
+							</execution>
+						</executions>
+					</plugin>
+					<plugin>
+						<groupId>org.cyclonedx</groupId>
+						<artifactId>cyclonedx-maven-plugin</artifactId>
+						<version>2.6.2</version>
+						<executions>
+							<execution>
+								<phase>package</phase>
+								<goals><goal>makeAggregateBom</goal></goals>
+							</execution>
+						</executions>
+					</plugin>
+				</plugins>
+			</build>
+		</profile>
+
+		<!-- Activate when deploying to the Central Repo. Also see https://central.sonatype.org/pages/apache-maven.html#nexus-staging-maven-plugin-for-deployment-and-release -->
+		<profile>
+			<id>release</id>
+			<build>
+				<plugins>
+					<plugin>
+						<groupId>org.apache.maven.plugins</groupId>
+						<artifactId>maven-gpg-plugin</artifactId>
+						<version>3.0.1</version>
+						<executions>
+							<execution>
+								<id>sign-artifacts</id>
+								<phase>verify</phase>
+								<goals>
+									<goal>sign</goal>
+								</goals>
+								<configuration>
+									<gpgArguments>
+										<arg>--pinentry-mode</arg>
+										<arg>loopback</arg>
+									</gpgArguments>
+								</configuration>
+							</execution>
+						</executions>
+					</plugin>
+				</plugins>
+			</build>
+		</profile>
+	</profiles>
+
 	<build>
 		<plugins>
+			<!-- Flattens the pom.xml files included in artifacts,
+			cf. https://www.mojohaus.org/flatten-maven-plugin/plugin-info.html --> 
 			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-resources-plugin</artifactId>
-			</plugin>
-			
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-shade-plugin</artifactId>
-				<executions>
-					<execution>
-						<id>make-shade</id>
-						<phase>package</phase>
+			    <groupId>org.codehaus.mojo</groupId>
+			    <artifactId>flatten-maven-plugin</artifactId>
+			    <version>1.2.2</version>
+			    <executions>
+			    	<execution>
+						<id>flatten</id>
+						<phase>process-resources</phase>
 						<goals>
-							<goal>shade</goal>
+							<goal>flatten</goal>
 						</goals>
 						<configuration>
-							<archive>
-								<manifest>
-									<addDefaultImplementationEntries>true</addDefaultImplementationEntries>
-									<addDefaultSpecificationEntries>true</addDefaultSpecificationEntries>
-								</manifest>
-							</archive>
-							<addMavenDescriptor>false</addMavenDescriptor>
-							<shadedArtifactAttached>true</shadedArtifactAttached>
-							<shadedClassifierName>jar-with-dependencies</shadedClassifierName>
-							<transformers>
-								<transformer
-									implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer" />
-								<transformer
-									implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
-									<manifestEntries>
-										<Main-Class>org.eclipse.steady.kb.Main</Main-Class>
-										<Implementation-Version>${project.version}</Implementation-Version>
-									</manifestEntries>
-								</transformer>
-							</transformers>
-							<filters>
-								<filter>
-									<artifact>*:*</artifact>
-									<excludes>
-										<exclude>META-INF/*.SF</exclude>
-										<exclude>META-INF/*.DSA</exclude>
-										<exclude>META-INF/*.RSA</exclude>
-									</excludes>
-								</filter>
-							</filters>
+							<flattenMode>clean</flattenMode>
 						</configuration>
 					</execution>
-				</executions>
-			</plugin>
-
-			<!-- Run the ITxx integration tests in alphabetical order -->
-			<plugin>
-				<groupId>org.apache.maven.plugins</groupId>
-				<artifactId>maven-failsafe-plugin</artifactId>
-				<configuration>
-					<runOrder>alphabetical</runOrder>
-				</configuration>
-				<executions>
-					<execution>
-						<id>integration-test</id>
-						<goals>
-							<goal>integration-test</goal>
-						</goals>
-					</execution>
 					<execution>
-						<id>verify</id>
+						<id>flatten.clean</id>
+						<phase>clean</phase>
 						<goals>
-							<goal>verify</goal>
+							<goal>clean</goal>
 						</goals>
 					</execution>
 				</executions>
 			</plugin>
+			
+			<plugin>
+				<groupId>org.springframework.boot</groupId>
+				<artifactId>spring-boot-maven-plugin</artifactId>
+			</plugin>
+
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-surefire-plugin</artifactId>
+				<version>3.0.0-M5</version>
+				<dependencies>
+					<dependency>
+						<groupId>org.apache.maven.surefire</groupId>
+						<artifactId>surefire-junit4</artifactId>
+						<version>3.0.0-M5</version>
+					</dependency>
+				</dependencies>
+			</plugin>
 		</plugins>
 	</build>
 </project>
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/ImportCommand.java b/kb-importer/src/main/java/org/eclipse/steady/kb/ImportCommand.java
new file mode 100644
index 000000000..6cf23f23f
--- /dev/null
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/ImportCommand.java
@@ -0,0 +1,233 @@
+/**
+ * This file is part of Eclipse Steady.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+ */
+package org.eclipse.steady.kb;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.HashMap;
+
+import org.apache.logging.log4j.Logger;
+import org.eclipse.steady.backend.BackendConnectionException;
+import org.eclipse.steady.backend.BackendConnector;
+import org.eclipse.steady.kb.model.Vulnerability;
+import org.eclipse.steady.kb.task.ExtractOrClone;
+import org.eclipse.steady.kb.task.ImportAffectedLibraries;
+import org.eclipse.steady.kb.task.ImportVulnerability;
+import org.eclipse.steady.kb.util.Metadata;
+import org.eclipse.steady.shared.util.FileUtil;
+import org.eclipse.steady.shared.util.StopWatch;
+
+import com.github.packageurl.MalformedPackageURLException;
+
+/**
+ * Imports information pertaining to a single vulnerability statement. To do so,
+ * it calls 3 tasks in method {@link ImportCommand#run()}:
+ * {@link ExtractOrClone}, {@link ImportVulnerability} and
+ * {@link ImportAffectedLibraries}.
+ */
+public class ImportCommand implements Runnable {
+
+  /** The file name of statements coming from Project KB. */
+  public static final String STATEMENT_YAML = "statement.yaml";
+
+  /** The file name of tarballs coming from Project KB, and which contain the
+   * source code changes created by the respective fix commits. */
+  public static final String SOURCE_TAR = "changed-source-code.tar.gz";
+
+  /** Constant <code>VERBOSE_OPTION="v"</code> */
+  public static final String VERBOSE_OPTION = "v";
+
+  /** Constant <code>UPLOAD_CONSTRUCT_OPTION="u"</code> */
+  public static final String UPLOAD_CONSTRUCT_OPTION = "u";
+
+  /** Constant <code>SKIP_CLONE_OPTION="u"</code> */
+  public static final String SKIP_CLONE_OPTION = "u";
+
+  /** Constant <code>OVERWRITE_OPTION="o"</code> */
+  public static final String OVERWRITE_OPTION = "o";
+
+  /** Constant <code>DELETE_OPTION="del"</code> */
+  public static final String DELETE_OPTION = "del";
+
+  /** Constant <code>DIRECTORY_OPTION="d"</code> */
+  public static final String DIRECTORY_OPTION = "d";
+
+  /** Constant <code>TIME_REFETCH_ALL_OPTION="t"</code> */
+  public static final String TIME_REFETCH_ALL_OPTION = "t";
+
+  /** Constant <code>DELETE="del"</code> */
+  public static final String DELETE = "del";
+  
+  /** Constant <code>SEQUENTIAL="seq"</code> */
+  public static final String SEQUENTIAL = "seq";
+
+  private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
+
+  private StopWatch stopWatch = null;
+  private Path vulnDir;
+  private String vulnId;
+  private HashMap<String, Object> args;
+
+  /**
+   * The {@link Manager} that started the command. Used to reflect the status of
+   * the import and maintain a list of failed imports.
+   */
+  Manager manager;
+
+  /**
+   * <p>Constructor for ImportCommand.</p>
+   *
+   * @param manager a {@link org.eclipse.steady.kb.Manager} object
+   * @param args a {@link java.util.HashMap} object
+   */
+  public ImportCommand(
+      Manager manager, HashMap<String, Object> args) {
+    this.manager = manager;
+    this.vulnDir = Paths.get((String) args.get(DIRECTORY_OPTION));
+    this.vulnId = vulnDir.getFileName().toString();
+    this.args = args;
+    this.stopWatch = new StopWatch(this.vulnId);
+  }
+
+  /**
+   * <p>Getter for the field <code>vulnId</code>.</p>
+   *
+   * @return a {@link java.lang.String} object
+   */
+  public String getVulnId() {
+    return this.vulnId;
+  }
+
+  /** {@inheritDoc} */
+  @Override
+  public void run() {
+    this.stopWatch.start();
+    manager.setVulnStatus(vulnId, Manager.VulnStatus.STARTING);
+
+    BackendConnector backend_connector = BackendConnector.getInstance();
+
+    // Does the vulnerability already exist?
+    boolean bugExists = false;
+    try {
+      bugExists = backend_connector.isBugExisting(vulnId);
+    } catch (BackendConnectionException e) {
+      manager.setVulnStatus(vulnId, Manager.VulnStatus.FAILED_CONNECTION);
+      manager.addFailure(vulnId, e);
+      this.stopWatch.stop(e);
+      return;
+    }
+
+    // Override or not?
+    Boolean overwrite = false;
+    if (args.containsKey(OVERWRITE_OPTION)) {
+      overwrite = (Boolean) args.get(OVERWRITE_OPTION);
+    }
+    if (bugExists) {
+      if (overwrite) {
+        args.put(DELETE, true);
+        log.info("Bug [{}] already exists in backend and will be overwritten", vulnId);
+      } else {
+        log.info("Bug [{}] already exists in backend, analysis will be skipped", vulnId);
+        manager.setVulnStatus(vulnId, Manager.VulnStatus.IMPORTED);
+        this.stopWatch.stop();
+        return;
+      }
+    }
+    else {
+      manager.addNewVulnerability(vulnId);
+      log.info("Bug [{}] does not exist in backend", vulnId);
+    }
+
+    Path statementPath = this.vulnDir.resolve(STATEMENT_YAML);
+
+    // statement.yaml does not exist? This should not happen, because the
+    // Manager only picks directories that contain a statement.yaml file.
+    if (!FileUtil.isAccessibleFile(statementPath)) {
+      ImportCommand.log.error("Cannot read [" + statementPath + "]");
+      manager.setVulnStatus(vulnId, Manager.VulnStatus.MALFORMED_INPUT);
+      this.stopWatch.stop();
+      return;
+    }
+    // Proceed with the import
+    else {
+
+      // Read statement.yaml
+      Vulnerability vuln;
+      try {
+        vuln = Metadata.getFromYaml(statementPath.toString());
+      } catch (IOException e) {
+        this.stopWatch.stop(e);
+        return;
+      }
+
+      // Statement does not have commits nor affected libs?
+      if ((vuln.getCommits() == null || vuln.getCommits().size() == 0)
+          && (vuln.getArtifacts() == null || vuln.getArtifacts().size() == 0)) {
+        log.warn("No fix commits or affected artifacts for vulnerability [" + vuln.getVulnId() + "]");
+        manager.setVulnStatus(vuln.getVulnId(), Manager.VulnStatus.MALFORMED_INPUT);
+        this.stopWatch.stop();
+        return;
+      }
+      
+      // Extract source code tarball (if any) or clone repo
+      else {
+        ExtractOrClone extractOrClone =
+            new ExtractOrClone(
+                this.manager,
+                vuln,
+                new File(this.vulnDir.toString()),
+                (boolean) args.get(SKIP_CLONE_OPTION));
+        extractOrClone.execute();
+        this.stopWatch.lap("Cloned repo or extracted source code tarball");
+      }
+
+      if (manager.getVulnStatus(vuln.getVulnId()) != Manager.VulnStatus.FAILED_EXTRACT_OR_CLONE
+          && manager.getVulnStatus(vuln.getVulnId()) != Manager.VulnStatus.SKIP_CLONE) {
+
+        manager.setVulnStatus(vuln.getVulnId(), Manager.VulnStatus.IMPORTING);
+
+        try {
+          ImportVulnerability importVulnerability = new ImportVulnerability();
+          importVulnerability.execute(vuln, args, backend_connector);
+          this.stopWatch.lap("Imported change list using the fix-commits");
+        } catch (IOException | BackendConnectionException e) {
+          manager.setVulnStatus(vuln.getVulnId(), Manager.VulnStatus.FAILED_IMPORT_VULN);
+          manager.addFailure(vuln.getVulnId(), e);
+          this.stopWatch.stop(e);
+          return;
+        }
+        
+        try {
+          ImportAffectedLibraries importAffectedLibraries = new ImportAffectedLibraries();
+          importAffectedLibraries.execute(vuln, args, backend_connector);
+          this.stopWatch.lap("Imported affected libraries");
+        } catch (IOException | MalformedPackageURLException | BackendConnectionException e) {
+          manager.setVulnStatus(vuln.getVulnId(), Manager.VulnStatus.FAILED_IMPORT_LIB);
+          manager.addFailure(vuln.getVulnId(), e);
+          this.stopWatch.stop(e);
+          return;
+        }
+        manager.setVulnStatus(vuln.getVulnId(), Manager.VulnStatus.IMPORTED);
+      }
+      this.stopWatch.stop();
+    }
+  }
+}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/Manager.java b/kb-importer/src/main/java/org/eclipse/steady/kb/Manager.java
new file mode 100644
index 000000000..a63b17721
--- /dev/null
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/Manager.java
@@ -0,0 +1,443 @@
+/**
+ * This file is part of Eclipse Steady.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+ */
+package org.eclipse.steady.kb;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.nio.file.StandardCopyOption;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ThreadPoolExecutor;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+
+import org.apache.http.conn.HttpHostConnectException;
+import org.eclipse.steady.backend.BackendConnectionException;
+import org.eclipse.steady.core.util.CoreConfiguration;
+import org.eclipse.steady.shared.util.DirWithFileSearch;
+import org.eclipse.steady.shared.util.FileUtil;
+import org.eclipse.steady.shared.util.ProcessWrapper;
+import org.eclipse.steady.shared.util.ProcessWrapperException;
+import org.eclipse.steady.shared.util.StopWatch;
+import org.eclipse.steady.shared.util.ThreadUtil;
+import org.eclipse.steady.shared.util.VulasConfiguration;
+
+import com.google.gson.Gson;
+/**
+ * Creates and executes threads for processing each vulnerability.
+ * Keeps track of the state of each one of them.
+ */
+public class Manager {
+
+  private static final org.apache.logging.log4j.Logger log =
+      org.apache.logging.log4j.LogManager.getLogger();
+
+  final String kaybeeBinaryPath =
+      VulasConfiguration.getGlobal()
+          .getConfiguration()
+          .getString("vulas.kb-importer.kaybeeBinaryPath");
+
+  final String kaybeeConfPath =
+      VulasConfiguration.getGlobal()
+          .getConfiguration()
+          .getString("vulas.kb-importer.kaybeeConfPath");
+
+  /**
+   * The folder into which kaybee pulls the statements.
+   * Should be changed as soon as kaybee merge is properly implemented.
+   */
+  private static final String KAYBEE_STMTS_PATH = ".kaybee/repositories/github.com_sap.project-kb_vulnerability-data/statements";
+
+  /**
+   * The data folder inside kb-importer's Docker container.
+   */
+  private static final String IMPORT_STMTS_PATH =
+    VulasConfiguration.getGlobal()
+        .getConfiguration()
+        .getString("vulas.kb-importer.statementsPath");
+  
+  private ThreadPoolExecutor executor;
+
+  private static Map<String, VulnStatus> vulnerabilitiesStatus = new HashMap<String, VulnStatus>();
+
+  private static Set<String> newVulnerabilities = new LinkedHashSet<String>();
+
+  // pairs of vulnId and reason for failure
+  private static Map<String, Exception> failures = new HashMap<String, Exception>();
+
+  Map<String, Lock> repoLocks = new HashMap<String, Lock>();
+
+  private StopWatch stopWatch = null;
+
+  private Path tmpDir = null;
+
+  public enum VulnStatus {
+    NOT_STARTED,
+    STARTING,
+    EXTRACTING,
+    CLONING,
+    IMPORTING,
+    IMPORTED,
+    FAILED_EXTRACT_OR_CLONE,
+    FAILED_CONNECTION,
+    SKIP_CLONE,
+    FAILED_IMPORT_LIB,
+    FAILED_IMPORT_VULN,
+    MALFORMED_INPUT
+  }
+
+  /**
+   * <p>Constructor for Manager.</p>
+   *
+   * @param backendConnector a {@link org.eclipse.steady.backend.BackendConnector} object
+   */
+  public Manager() {
+    this.createNewExecutor();
+    try {
+      this.tmpDir = FileUtil.createTmpDir("import");
+    } catch (IOException e) {
+      log.error("Error creating temp dir: " + e.getMessage());
+    }
+  }
+
+  /**
+   * <p>createNewExecutor.</p>
+   */
+  public void createNewExecutor() {
+    this.executor = (ThreadPoolExecutor) Executors.newFixedThreadPool(ThreadUtil.getNoThreads());
+  }
+
+  /**
+   * Adds a vulnerability that does not yet exist in the backend. Called by {@link ImportCommand#run()}.
+   *
+   * @param vulnId a {@link java.lang.String} object
+   */
+  public void addNewVulnerability(String vulnId) {
+    newVulnerabilities.add(vulnId);
+  }
+
+  /**
+   * <p>setVulnStatus.</p>
+   *
+   * @param vulnId a {@link java.lang.String} object
+   * @param vulnStatus a {@link org.eclipse.steady.kb.Manager.VulnStatus} object
+   */
+  public void setVulnStatus(String vulnId, VulnStatus vulnStatus) {
+    vulnerabilitiesStatus.put(vulnId, vulnStatus);
+  }
+
+  /**
+   * <p>getVulnStatus.</p>
+   *
+   * @param vulnId a {@link java.lang.String} object
+   * @return a {@link org.eclipse.steady.kb.Manager.VulnStatus} object
+   */
+  public VulnStatus getVulnStatus(String vulnId) {
+    if (vulnerabilitiesStatus.containsKey(vulnId)) {
+      return vulnerabilitiesStatus.get(vulnId);
+    } else return null;
+  }
+
+  /**
+   * <p>addFailure.</p>
+   *
+   * @param vulnId a {@link java.lang.String} object
+   * @param e a {@link java.lang.Exception} object
+   */
+  public void addFailure(String vulnId, Exception e) {
+    failures.put(vulnId, e);
+  }
+
+  /**
+   * <p>lockRepo.</p>
+   *
+   * @param repo a {@link java.lang.String} object
+   */
+  public void lockRepo(String repo) {
+    if (!repoLocks.containsKey(repo)) {
+      repoLocks.put(repo, new ReentrantLock());
+    }
+    repoLocks.get(repo).lock();
+  }
+
+  /**
+   * <p>unlockRepo.</p>
+   *
+   * @param repo a {@link java.lang.String} object
+   */
+  public void unlockRepo(String repo) {
+    if (!repoLocks.containsKey(repo)) {
+      return;
+    }
+    repoLocks.get(repo).unlock();
+  }
+
+  /**
+   * Returns true if an import is underway, false otherwise.
+   *
+   * @return a boolean
+   */
+  public boolean isRunningStart() {
+    return this.stopWatch != null && this.stopWatch.isRunning();
+  }
+
+  /**
+   * Calls kaybee and starts the import of all statements in the data folder.
+   *
+   * @param mapCommandOptionValues a {@link java.util.HashMap} object
+   */
+  public synchronized void start(HashMap<String, Object> mapCommandOptionValues) {
+
+    newVulnerabilities = new LinkedHashSet<String>();
+
+    this.stopWatch = new StopWatch("Import vulnerabilities").start();
+    
+    try {
+      kaybeeUpdate();
+      this.stopWatch.lap("Updated kaybee", true);
+
+      kaybeePull();
+      this.stopWatch.lap("Ran kaybee pull", true);
+      
+      // Normally, we would call 'kaybee merge", but since this functionality
+      // has not been implemented yet, we simply copy the folder where the statements
+      // have been pulled to to another folder
+      FileUtil.copy(Paths.get(KAYBEE_STMTS_PATH), Paths.get(IMPORT_STMTS_PATH).getParent(), Paths.get(IMPORT_STMTS_PATH).getFileName(), StandardCopyOption.REPLACE_EXISTING);
+      this.stopWatch.lap("Copied statements", true);
+
+      setUploadConfiguration(mapCommandOptionValues);
+
+      List<String> vulnIds = this.identifyVulnerabilitiesToImport(IMPORT_STMTS_PATH);
+      startList(IMPORT_STMTS_PATH, mapCommandOptionValues, vulnIds);
+      retryFailed(IMPORT_STMTS_PATH, mapCommandOptionValues);
+
+      this.stopWatch.stop();
+    } catch (Exception e) {
+      this.stopWatch.stop(e);
+    }
+  }
+
+  /**
+   * Keeps retrying vulnerabilities that failed due to the high amount of requests.
+   *
+   * @param statementsPath a {@link java.lang.String} object
+   * @param mapCommandOptionValues a {@link java.util.HashMap} object
+   */
+  public void retryFailed(String statementsPath, HashMap<String, Object> mapCommandOptionValues) {
+
+    List<String> failuresToRetry = new ArrayList<String>();
+    while (true) {
+      for (String vulnId : failures.keySet()) {
+        if (failures.get(vulnId) instanceof BackendConnectionException
+            || failures.get(vulnId) instanceof HttpHostConnectException) {
+          failuresToRetry.add(vulnId);
+        }
+      }
+      if (failuresToRetry.isEmpty()) {
+        break;
+      } else {
+        log.info(
+            "Retrying [" + Integer.toString(failuresToRetry.size()) + "] failed vulnerabilities...");
+        startList(statementsPath, mapCommandOptionValues, failuresToRetry);
+      }
+    }
+  }
+
+  /**
+   * Searches in the given folder for directories containing a
+   * <p>statements.yaml</p> file, which correspond to vulnerabilities being
+   * imported later on.
+   *
+   * @param statementsPath a {@link java.lang.String} object
+   * @return a {@link java.util.List} object
+   */
+  public List<String> identifyVulnerabilitiesToImport(String statementsPath) {
+    final DirWithFileSearch search = new DirWithFileSearch("statement.yaml");
+    Set<Path> vulnDirsPaths = search.search(Paths.get(statementsPath));
+    List<String> vulnIds = new ArrayList<String>();
+    for (Path dirPath : vulnDirsPaths) {
+      String vulnId = dirPath.getFileName().toString();
+      log.debug("Found directory [" + dirPath + "] for vulnerability [" + vulnId + "]");
+      setVulnStatus(vulnId, VulnStatus.NOT_STARTED);
+      vulnIds.add(vulnId);
+    }
+    return vulnIds;
+  }
+
+  /**
+   * Creates an {@link ImportCommand} for every vulnerability comprised in the
+   * given list. Depending on the presence of {@link ImportCommand.SEQUENTIAL}
+   * in the keys of the given arguments, those import commands will be executed
+   * sequentially are given to the thread pool executor
+   * {@link Manager#executor}.
+   *
+   * @param statementsPath a {@link java.lang.String} refering to the parent
+   * folder of the vulnerability folders to import
+   * @param mapCommandOptionValues a {@link java.util.HashMap} with arguments,
+   * incl. {@link ImportCommand.SEQUENTIAL}
+   * @param vulnIds a {@link java.util.List} of vulnerabilities to be imported
+   */
+  public synchronized void startList(
+      String statementsPath, HashMap<String, Object> mapCommandOptionValues, List<String> vulnIds) {
+
+    if (this.executor.isShutdown() || this.executor.isTerminated()) {
+      this.createNewExecutor();
+    }
+
+    failures = new HashMap<String, Exception>();
+
+    // Loop vulnerabilities
+    for (String vulnId : vulnIds) {
+      Path vulnDirPath = Paths.get(statementsPath, vulnId);
+
+      // Copy the arguments to avoid concurrent modification
+      HashMap<String, Object> args = new HashMap<String, Object>(mapCommandOptionValues);
+      args.put(ImportCommand.DIRECTORY_OPTION, vulnDirPath.toString());
+
+      // Create the import command. Start right away or submit to executor.
+      ImportCommand command = new ImportCommand(this, args);
+      if (mapCommandOptionValues.containsKey(ImportCommand.SEQUENTIAL)) {
+        command.run();
+      } else {
+        executor.submit(command);
+      }
+    }
+
+    // Don't accept new vulns and wait for termination
+    try {
+      executor.shutdown();
+      executor.awaitTermination(24, TimeUnit.HOURS);
+    } catch (InterruptedException e) {
+      log.error("Process interrupted: " + e.getMessage());
+    }
+  }
+
+  private void setUploadConfiguration(HashMap<String, Object> args) {
+    Object uploadConstruct = args.get(ImportCommand.UPLOAD_CONSTRUCT_OPTION);
+    VulasConfiguration.getGlobal()
+        .setProperty(
+            CoreConfiguration.BACKEND_CONNECT,
+            (uploadConstruct != null
+                ? CoreConfiguration.ConnectType.READ_WRITE.toString()
+                : CoreConfiguration.ConnectType.READ_ONLY.toString()));
+  }
+
+  /**
+   * Runs 'kaybe update --force' to update the kaybee binary.
+   *
+   * @throws java.io.IOException if any.
+   * @throws java.lang.InterruptedException if any.
+   */
+  public void kaybeeUpdate() throws ProcessWrapperException, InterruptedException {
+    ProcessWrapper pw = new ProcessWrapper().setCommand(Paths.get(kaybeeBinaryPath), "update", "--force").setPath(this.tmpDir);
+    Thread t = new Thread(pw, "kaybee-update");
+    t.start();
+    t.join();
+  }
+
+  /**
+   * Runs 'kaybee pull -c <config>' to pull statements from the configured source repositories.
+   *
+   * @throws java.io.IOException if any.
+   * @throws java.lang.InterruptedException if any.
+   */
+  public void kaybeePull() throws Exception {
+    ProcessWrapper pw = new ProcessWrapper().setCommand(Paths.get(kaybeeBinaryPath), "pull", "-c", kaybeeConfPath).setPath(this.tmpDir);
+    Thread t = new Thread(pw, "kaybee-pull");
+    t.start();
+    t.join();
+  }
+
+  /**
+   * Stops all import threads and waits for their termination.
+   */
+  public void stop() {
+    try {
+      log.info("Stopping manager...");
+      executor.shutdownNow();
+      executor.awaitTermination(24, TimeUnit.HOURS);
+    } catch (InterruptedException e) {
+      log.error("Process interrupted: " + e.getMessage(), e);
+    }
+  }
+
+  /**
+   * Imports a single vulnerability whose statement.yaml is expected to be in
+   * the correct folder.
+   *
+   * @param vulnDirStr a {@link java.lang.String} object
+   * @param mapCommandOptionValues a {@link java.util.HashMap} object
+   * @param vulnId a {@link java.lang.String} object
+   */
+  public void importSingleVuln(HashMap<String, Object> mapCommandOptionValues, String vulnId) {
+    String dir = IMPORT_STMTS_PATH + File.separator + vulnId;
+    log.info("Importing vulnerability [" + vulnId + "] from directory [" + dir + "]...");
+
+    // It is necessary to copy the arguments to avoid concurrent modification
+    HashMap<String, Object> args = new HashMap<String, Object>(mapCommandOptionValues);
+    args.put(ImportCommand.DIRECTORY_OPTION, dir);
+
+    ImportCommand command = new ImportCommand(this, args);
+    command.run();
+  }
+
+  /**
+   * <p>status.</p>
+   *
+   * @return a {@link java.lang.String} object
+   */
+  public String status() {
+    HashMap<String, Object> statusMap = new HashMap<String, Object>();
+
+    // Counter for each status
+    HashMap<VulnStatus, Integer> statusCount = new HashMap<VulnStatus, Integer>();
+    for (String vul: vulnerabilitiesStatus.keySet()) {
+      if (!statusCount.containsKey(vulnerabilitiesStatus.get(vul))) {
+        statusCount.put(vulnerabilitiesStatus.get(vul), 0);
+      }
+      statusCount.put(vulnerabilitiesStatus.get(vul), statusCount.get(vulnerabilitiesStatus.get(vul)) + 1);
+    }
+    statusMap.put("count", statusCount);
+
+    // New vulns
+    HashMap<String, VulnStatus> newVulnStatus = new HashMap<String, VulnStatus>();
+    for (String vulnId : newVulnerabilities) {
+      newVulnStatus.put(vulnId, vulnerabilitiesStatus.get(vulnId));
+    }    
+    statusMap.put("new_vulnerabilities", newVulnerabilities);
+
+    // Failures
+    HashMap<String, String> failureReasons = new HashMap<String, String>();
+    for (String vulnId : failures.keySet()) {
+      failureReasons.put(vulnId, failures.get(vulnId).toString());
+    }
+    statusMap.put("failures", failureReasons);
+
+    // Return JSON
+    return new Gson().toJson(statusMap);
+  }
+}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/command/Command.java b/kb-importer/src/main/java/org/eclipse/steady/kb/command/Command.java
deleted file mode 100755
index 754d51931..000000000
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/command/Command.java
+++ /dev/null
@@ -1,67 +0,0 @@
-/**
- * This file is part of Eclipse Steady.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
- */
-package org.eclipse.steady.kb.command;
-
-import java.util.HashMap;
-
-import org.apache.commons.cli.Options;
-import org.eclipse.steady.kb.exception.ValidationException;
-
-/**
- * Command Interface
- */
-public interface Command {
-
-  enum NAME {
-    HELP,
-    VERSION,
-    IMPORT;
-  }
-
-  /**
-   * get the command name
-   *
-   * @return a {@link java.lang.String}
-   */
-  Command.NAME getCommandName();
-
-  /**
-   * run a command. logic to execute a command with arguments
-   *
-   * @param args a {@link java.util.Map}}
-   */
-  void run(HashMap<String, Object> args);
-
-  // TODO: may be we might have to change this to our own bean like
-  // List<com.sap.psr.vulas.kb.model.Options> rather than the apache-cli Options
-  /**
-   * get command options
-   *
-   * @return command options
-   */
-  Options getOptions();
-
-  /**
-   * validate command with command arguments. Throw a validation exception on any validation error
-   *
-   * @param args a {@link java.util.Map}
-   * @throws org.eclipse.steady.kb.exception.ValidationException if any.
-   */
-  void validate(HashMap<String, Object> args) throws ValidationException;
-}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/command/CommandExecutor.java b/kb-importer/src/main/java/org/eclipse/steady/kb/command/CommandExecutor.java
deleted file mode 100755
index edc3103f5..000000000
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/command/CommandExecutor.java
+++ /dev/null
@@ -1,136 +0,0 @@
-/**
- * This file is part of Eclipse Steady.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
- */
-package org.eclipse.steady.kb.command;
-
-import java.nio.file.Paths;
-import java.util.HashMap;
-import java.util.Iterator;
-import java.util.Map;
-import java.util.ServiceLoader;
-import org.apache.commons.cli.HelpFormatter;
-import org.apache.commons.cli.Options;
-import org.apache.logging.log4j.Logger;
-import org.eclipse.steady.kb.exception.CommandLineParserException;
-import org.eclipse.steady.kb.exception.ValidationException;
-
-/**
- * command executor
- */
-public class CommandExecutor {
-
-  private static final String DIRECTORY_OPTION = "d";
-  private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
-  private Map<Command.NAME, Command> commands = new HashMap<>();
-  private static CommandExecutor commandExecutor;
-
-  private CommandExecutor() {
-    init();
-  }
-
-  /**
-   * <p>getInstance.</p>
-   *
-   * @return a {@link org.eclipse.steady.kb.command.CommandExecutor} object
-   */
-  public static synchronized CommandExecutor getInstance() {
-    if (commandExecutor == null) {
-      commandExecutor = new CommandExecutor();
-    }
-    return commandExecutor;
-  }
-
-  private void init() {
-    ServiceLoader<Command> serviceProviders = ServiceLoader.load(Command.class);
-    Iterator<Command> iterator = serviceProviders.iterator();
-    while (iterator.hasNext()) {
-      Command command = iterator.next();
-      commands.put(command.getCommandName(), command);
-    }
-  }
-
-  /**
-   * command executor
-   *
-   * @param _args a array of {java.lang.String}
-   */
-  public void execute(String _args[]) {
-    if (_args.length == 0) {
-      log.error("No arguments passed");
-      return;
-    }
-
-    Command command = null;
-    try {
-      command = commands.get(Command.NAME.valueOf(_args[0].toUpperCase()));
-    } catch (IllegalArgumentException e) {
-      // skip when an unknown command name is passed. Default to import
-    }
-
-    if (command == null) {
-      command = new Import();
-    }
-
-    Options commandOptions = command.getOptions();
-
-    HashMap<String, Object> mapCommandOptionValues;
-    try {
-      mapCommandOptionValues = CommandParser.parse(_args, commandOptions);
-      Object rootDirObj = mapCommandOptionValues.get(DIRECTORY_OPTION);
-      if (rootDirObj != null) {
-        String rootDir = (String) rootDirObj;
-        rootDir = getAbsolutePath(rootDir);
-        mapCommandOptionValues.put(DIRECTORY_OPTION, rootDir);
-      }
-    } catch (CommandLineParserException e) {
-      log.error(e.getMessage());
-      printHelp(commandOptions);
-      return;
-    }
-
-    try {
-      command.validate(mapCommandOptionValues);
-    } catch (ValidationException e) {
-      log.error(e.getMessage());
-      return;
-    }
-
-    command.run(mapCommandOptionValues);
-  }
-
-  /**
-   * Print command help
-   *
-   * @param a {@link org.apache.commons.cli.Options}
-   */
-  private void printHelp(Options commandOptions) {
-    // Showing import help
-    HelpFormatter formatter = new HelpFormatter();
-    formatter.printHelp("java -jar <jar> <options>", new Import().getOptions());
-  }
-
-  /**
-   * get directory absolute path if it is relative
-   *
-   * @param rootDir
-   * @return absolute path
-   */
-  private String getAbsolutePath(String rootDir) {
-    return Paths.get(rootDir).toAbsolutePath().normalize().toString();
-  }
-}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/command/CommandParser.java b/kb-importer/src/main/java/org/eclipse/steady/kb/command/CommandParser.java
deleted file mode 100755
index 8da0a0ea2..000000000
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/command/CommandParser.java
+++ /dev/null
@@ -1,70 +0,0 @@
-/**
- * This file is part of Eclipse Steady.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
- */
-package org.eclipse.steady.kb.command;
-
-import java.util.Collection;
-import java.util.HashMap;
-
-import org.apache.commons.cli.CommandLine;
-import org.apache.commons.cli.CommandLineParser;
-import org.apache.commons.cli.DefaultParser;
-import org.apache.commons.cli.Option;
-import org.apache.commons.cli.Options;
-import org.apache.commons.cli.ParseException;
-import org.eclipse.steady.kb.exception.CommandLineParserException;
-
-/**
- * command parser
- */
-public class CommandParser {
-  /**
-   * parse a command
-   *
-   * @param _args array of {@link java.lang.String}
-   * @param options a {@link org.apache.commons.cli.Options} object
-   * @throws org.eclipse.steady.kb.exception.CommandLineParserException if any.
-   * @return a {@link java.util.HashMap} object
-   */
-  public static HashMap<String, Object> parse(String[] _args, Options options)
-      throws CommandLineParserException {
-    final CommandLineParser parser = new DefaultParser();
-    CommandLine cmd = null;
-    try {
-      cmd = parser.parse(options, _args, true);
-    } catch (ParseException e) {
-      throw new CommandLineParserException(e.getMessage());
-    }
-
-    HashMap<String, Object> mapOptionValues = new HashMap<>();
-    Collection<Option> optionCollection = options.getOptions();
-    for (Option option : optionCollection) {
-      if (option.hasArg()) {
-        mapOptionValues.put(option.getOpt(), cmd.getOptionValue(option.getOpt()));
-      } else {
-        if (cmd.hasOption(option.getOpt()) || cmd.hasOption(option.getLongOpt())) {
-          mapOptionValues.put(option.getOpt(), true);
-        } else {
-          mapOptionValues.put(option.getOpt(), false);
-        }
-      }
-    }
-
-    return mapOptionValues;
-  }
-}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/command/Help.java b/kb-importer/src/main/java/org/eclipse/steady/kb/command/Help.java
deleted file mode 100755
index 8ad0f0bac..000000000
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/command/Help.java
+++ /dev/null
@@ -1,57 +0,0 @@
-/**
- * This file is part of Eclipse Steady.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
- */
-package org.eclipse.steady.kb.command;
-
-import java.util.HashMap;
-import org.apache.commons.cli.HelpFormatter;
-import org.apache.commons.cli.Options;
-import org.eclipse.steady.kb.exception.ValidationException;
-
-/**
- * help command
- */
-public class Help implements Command {
-
-  /** {@inheritDoc} */
-  @Override
-  public void run(HashMap<String, Object> args) {
-    // Showing help of import command
-    Command command = new Import();
-    HelpFormatter formatter = new HelpFormatter();
-    formatter.printHelp("java -jar <jar> <options>", command.getOptions());
-  }
-
-  /** {@inheritDoc} */
-  @Override
-  public Options getOptions() {
-    return new Options();
-  }
-
-  /** {@inheritDoc} */
-  @Override
-  public void validate(HashMap<String, Object> args) throws ValidationException {
-    // Nothing to validate as help does not have any args
-  }
-
-  /** {@inheritDoc} */
-  @Override
-  public Command.NAME getCommandName() {
-    return Command.NAME.HELP;
-  }
-}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/command/Import.java b/kb-importer/src/main/java/org/eclipse/steady/kb/command/Import.java
deleted file mode 100755
index 6aa443c08..000000000
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/command/Import.java
+++ /dev/null
@@ -1,168 +0,0 @@
-/**
- * This file is part of Eclipse Steady.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
- */
-package org.eclipse.steady.kb.command;
-
-import java.io.File;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Paths;
-import java.util.HashMap;
-import java.util.List;
-
-import com.google.gson.JsonSyntaxException;
-
-import org.apache.commons.cli.Options;
-import org.apache.logging.log4j.Logger;
-import org.eclipse.steady.backend.BackendConnector;
-import org.eclipse.steady.core.util.CoreConfiguration;
-import org.eclipse.steady.kb.exception.ValidationException;
-import org.eclipse.steady.kb.model.Vulnerability;
-import org.eclipse.steady.kb.task.Task;
-import org.eclipse.steady.kb.task.TaskProvider;
-import org.eclipse.steady.kb.util.Metadata;
-import org.eclipse.steady.shared.util.FileUtil;
-import org.eclipse.steady.shared.util.VulasConfiguration;
-
-/**
- * import command
- */
-public class Import implements Command {
-
-  private static final String METADATA_JSON = "metadata.json";
-  private static final String UPLOAD_CONSTRUCT_OPTION = "u";
-  private static final String DIRECTORY_OPTION = "d";
-  private static final String OVERWRITE_OPTION = "o";
-  private static final String VERBOSE_OPTION = "v";
-
-  private static final String UPLOAD_LONG_OPTION = "upload";
-  private static final String VERBOSE_LONG_OPTION = "verbose";
-  private static final String OVERWRITE_LONG_OPTION = "overwrite";
-  private static final String DIRECTORY_LONG_OPTION = "directory";
-
-  private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
-
-  /** {@inheritDoc} */
-  @Override
-  public Command.NAME getCommandName() {
-    return Command.NAME.IMPORT;
-  }
-
-  /** {@inheritDoc} */
-  @Override
-  public void run(HashMap<String, Object> args) {
-    String dirPath = (String) args.get(DIRECTORY_OPTION);
-
-    // Whether to upload JSON to the backend or save to the disk
-    Object uploadConstruct = args.get(UPLOAD_CONSTRUCT_OPTION);
-    VulasConfiguration.getGlobal()
-        .setProperty(
-            CoreConfiguration.BACKEND_CONNECT,
-            (uploadConstruct != null
-                ? CoreConfiguration.ConnectType.READ_WRITE.toString()
-                : CoreConfiguration.ConnectType.READ_ONLY.toString()));
-
-    if (FileUtil.isAccessibleFile(dirPath + File.separator + METADATA_JSON)) {
-      importVuln(args, dirPath);
-    } else if (FileUtil.isAccessibleDirectory(dirPath)) {
-      File directory = new File(dirPath);
-      File[] fList = directory.listFiles();
-      if (fList != null) {
-        for (File file : fList) {
-          if (file.isDirectory()) {
-            if (FileUtil.isAccessibleFile(
-                file.getAbsolutePath() + File.separator + METADATA_JSON)) {
-              importVuln(args, file.getAbsolutePath());
-            } else {
-              Import.log.warn(
-                  "Skipping {} as the directory does not contain metdata.json file",
-                  file.getAbsolutePath());
-            }
-          }
-        }
-      }
-
-    } else {
-      Import.log.error("Invalid directory {}", dirPath);
-    }
-  }
-
-  private void importVuln(HashMap<String, Object> args, String dirPath) {
-    Vulnerability vuln = null;
-    try {
-      vuln = Metadata.getVulnerabilityMetadata(dirPath);
-    } catch (JsonSyntaxException | IOException e1) {
-      Import.log.error(e1.getMessage(), e1);
-      return;
-    }
-
-    if (vuln == null) {
-      Import.log.error("Please specify the vulerability id in the json");
-      return;
-    }
-
-    List<Task> importTasks = TaskProvider.getInstance().getTasks(Command.NAME.IMPORT);
-
-    for (Task task : importTasks) {
-      try {
-        args.put(DIRECTORY_OPTION, dirPath);
-        task.execute(vuln, args, BackendConnector.getInstance());
-      } catch (Exception e) {
-        log.error(
-            "Got ["
-                + e.getClass().getName()
-                + "] when importing vulnerability ["
-                + vuln.getVulnId()
-                + "]: "
-                + e.getMessage(),
-            e);
-      }
-    }
-  }
-
-  /** {@inheritDoc} */
-  @Override
-  public Options getOptions() {
-    Options options = new Options();
-    options.addRequiredOption(
-        DIRECTORY_OPTION,
-        DIRECTORY_LONG_OPTION,
-        true,
-        "directory containing mutiple commit folders with meta files or directory containing"
-            + " multiple vulerability folders having mutiple commit folders with meta files");
-    options.addOption(
-        OVERWRITE_OPTION,
-        OVERWRITE_LONG_OPTION,
-        false,
-        "overwrite the bug if it already exists in the backend");
-    options.addOption(VERBOSE_OPTION, VERBOSE_LONG_OPTION, false, "Verbose mode");
-    options.addOption(
-        UPLOAD_CONSTRUCT_OPTION, UPLOAD_LONG_OPTION, false, "Upload construct changes");
-
-    return options;
-  }
-
-  /** {@inheritDoc} */
-  @Override
-  public void validate(HashMap<String, Object> args) throws ValidationException {
-    String dir = (String) args.get(DIRECTORY_OPTION);
-    if (!Files.isDirectory(Paths.get(dir))) {
-      throw new ValidationException("directory " + dir + "does not exist");
-    }
-  }
-}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/command/Version.java b/kb-importer/src/main/java/org/eclipse/steady/kb/command/Version.java
deleted file mode 100755
index db3e19947..000000000
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/command/Version.java
+++ /dev/null
@@ -1,63 +0,0 @@
-/**
- * This file is part of Eclipse Steady.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
- */
-package org.eclipse.steady.kb.command;
-
-import java.util.HashMap;
-import org.apache.commons.cli.Options;
-import org.apache.commons.lang.StringUtils;
-import org.apache.logging.log4j.Logger;
-import org.eclipse.steady.kb.Main;
-import org.eclipse.steady.kb.exception.ValidationException;
-
-/**
- * version command
- */
-public class Version implements Command {
-
-  private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
-
-  /** {@inheritDoc} */
-  @Override
-  public void run(HashMap<String, Object> args) {
-    String vulasRelease = Main.class.getPackage().getImplementationVersion();
-    if (StringUtils.isEmpty(vulasRelease)) {
-      log.error("unable to get vulas version");
-    } else {
-      log.info(vulasRelease);
-    }
-  }
-
-  /** {@inheritDoc} */
-  @Override
-  public Options getOptions() {
-    return new Options();
-  }
-
-  /** {@inheritDoc} */
-  @Override
-  public void validate(HashMap<String, Object> args) throws ValidationException {
-    // Nothing to validate as help does not have any args
-  }
-
-  /** {@inheritDoc} */
-  @Override
-  public Command.NAME getCommandName() {
-    return Command.NAME.VERSION;
-  }
-}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/exception/CommandLineParserException.java b/kb-importer/src/main/java/org/eclipse/steady/kb/exception/CommandLineParserException.java
deleted file mode 100755
index 007362f77..000000000
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/exception/CommandLineParserException.java
+++ /dev/null
@@ -1,54 +0,0 @@
-/**
- * This file is part of Eclipse Steady.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
- */
-package org.eclipse.steady.kb.exception;
-
-/**
- * Command Line parser exception
- */
-public class CommandLineParserException extends Exception {
-  private static final long serialVersionUID = -4923677968243017658L;
-
-  /**
-   * <p>Constructor for CommandLineParserException.</p>
-   *
-   * @param message a {@link java.lang.String} object
-   */
-  public CommandLineParserException(String message) {
-    super(message);
-  }
-
-  /**
-   * <p>Constructor for CommandLineParserException.</p>
-   *
-   * @param message a {@link java.lang.String} object
-   * @param throwable a {@link java.lang.Throwable} object
-   */
-  public CommandLineParserException(String message, Throwable throwable) {
-    super(message, throwable);
-  }
-
-  /**
-   * <p>Constructor for CommandLineParserException.</p>
-   *
-   * @param throwable a {@link java.lang.Throwable} object
-   */
-  public CommandLineParserException(Throwable throwable) {
-    super(throwable);
-  }
-}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/model/Artifact.java b/kb-importer/src/main/java/org/eclipse/steady/kb/model/Artifact.java
index 1ae12170b..d083a877b 100755
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/model/Artifact.java
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/model/Artifact.java
@@ -19,7 +19,7 @@
 package org.eclipse.steady.kb.model;
 
 /**
- * <p>Artifact class.</p>
+ * Information about the affectedness of artifacts contained in a statement.yaml file.
  */
 public class Artifact {
   private String id;
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/model/Commit.java b/kb-importer/src/main/java/org/eclipse/steady/kb/model/Commit.java
index 93b4832de..c6658f0e8 100755
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/model/Commit.java
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/model/Commit.java
@@ -21,7 +21,7 @@
 import com.google.gson.annotations.SerializedName;
 
 /**
- * Commit information
+ * A commit in a statement.yaml file.
  */
 public class Commit {
   private String timestamp;
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/model/Note.java b/kb-importer/src/main/java/org/eclipse/steady/kb/model/Note.java
index 819eaf605..0f6a98105 100755
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/model/Note.java
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/model/Note.java
@@ -21,7 +21,7 @@
 import java.util.List;
 
 /**
- * <p>Note class.</p>
+ * A note contained in a statement.yaml file.
  */
 public class Note {
   private List<String> links;
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/model/Vulnerability.java b/kb-importer/src/main/java/org/eclipse/steady/kb/model/Vulnerability.java
index a7fe81567..8d45d594f 100755
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/model/Vulnerability.java
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/model/Vulnerability.java
@@ -18,11 +18,13 @@
  */
 package org.eclipse.steady.kb.model;
 
+import java.util.ArrayList;
 import java.util.List;
+
 import com.google.gson.annotations.SerializedName;
 
 /**
- * Vulnerability information
+ * Vulnerability information contained in a statement.yaml file.
  */
 public class Vulnerability {
   @SerializedName("vulnerability_id")
@@ -32,8 +34,11 @@ public class Vulnerability {
   private List<Artifact> artifacts;
 
   private List<Note> notes;
+  
   private List<String> aliases;
 
+  private List<Commit> commits = new ArrayList<Commit>();
+
   /**
    * <p>Getter for the field <code>vulnId</code>.</p>
    *
@@ -105,4 +110,22 @@ public List<String> getAliases() {
   public void setAliases(List<String> aliases) {
     this.aliases = aliases;
   }
+
+  /**
+   * <p>Getter for the field <code>commits</code>.</p>
+   *
+   * @return a {@link java.util.List} object
+   */
+  public List<Commit> getCommits() {
+    return commits;
+  }
+
+  /**
+   * <p>Setter for the field <code>commits</code>.</p>
+   *
+   * @param commits a {@link java.util.List} object
+   */
+  public void setCommits(List<Commit> commits) {
+    this.commits = commits;
+  }
 }
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/Main.java b/kb-importer/src/main/java/org/eclipse/steady/kb/model/package-info.java
similarity index 70%
rename from kb-importer/src/main/java/org/eclipse/steady/kb/Main.java
rename to kb-importer/src/main/java/org/eclipse/steady/kb/model/package-info.java
index d893300a6..650014321 100755
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/Main.java
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/model/package-info.java
@@ -16,20 +16,9 @@
  * SPDX-License-Identifier: Apache-2.0
  * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
  */
-package org.eclipse.steady.kb;
-
-import org.eclipse.steady.kb.command.CommandExecutor;
-
 /**
- * <p>Main class.</p>
+ * Classes in this package hold and encapsulate the information contained in
+ * statement.yaml files coming from Project KB. The statement itself corresponds
+ * to class {@link Vulnerability}.
  */
-public class Main {
-  /**
-   * <p>main.</p>
-   *
-   * @param _args an array of {@link java.lang.String} objects
-   */
-  public static void main(String[] _args) {
-    CommandExecutor.getInstance().execute(_args);
-  }
-}
+package org.eclipse.steady.kb.model;
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/rest/ConfigurationController.java b/kb-importer/src/main/java/org/eclipse/steady/kb/rest/ConfigurationController.java
new file mode 100644
index 000000000..c57421c6d
--- /dev/null
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/rest/ConfigurationController.java
@@ -0,0 +1,67 @@
+/**
+ * This file is part of Eclipse Steady.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+ */
+package org.eclipse.steady.kb.rest;
+
+import org.eclipse.steady.shared.json.model.KeyValue;
+import org.eclipse.steady.shared.util.VulasConfiguration;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * <p>ConfigurationController class.</p>
+ */
+@RestController
+@CrossOrigin("*")
+@RequestMapping("/configuration")
+public class ConfigurationController {
+
+  private static Logger log = LoggerFactory.getLogger(ConfigurationController.class);
+
+  /**
+   * Returns an array of {@link KeyValue}s with configuration settings read from {@link VulasConfiguration}.
+   *
+   * @return 404 {@link HttpStatus#NOT_FOUND} if library with given SHA1 does not exist, 200 {@link HttpStatus#OK} if the library is found
+   * @param subset a {@link java.lang.String} object.
+   */
+  @RequestMapping(
+      value = "",
+      method = RequestMethod.GET,
+      produces = {"application/json;charset=UTF-8"})
+  public ResponseEntity<KeyValue[]> getConfiguration(
+      @RequestParam(value = "subset", required = false, defaultValue = "") String subset) {
+    try {
+      KeyValue[] values = null;
+      if (subset == null || subset.equals(""))
+        values = KeyValue.toKeyValue(VulasConfiguration.getGlobal().getConfiguration());
+      else
+        values =
+            KeyValue.toKeyValue(VulasConfiguration.getGlobal().getConfiguration().subset(subset));
+      return new ResponseEntity<KeyValue[]>(values, HttpStatus.OK);
+    } catch (Exception enfe) {
+      return new ResponseEntity<KeyValue[]>(HttpStatus.INTERNAL_SERVER_ERROR);
+    }
+  }
+}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/rest/ImportController.java b/kb-importer/src/main/java/org/eclipse/steady/kb/rest/ImportController.java
new file mode 100644
index 000000000..35a6fcb14
--- /dev/null
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/rest/ImportController.java
@@ -0,0 +1,266 @@
+/**
+ * This file is part of Eclipse Steady.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+ */
+package org.eclipse.steady.kb.rest;
+
+import java.util.HashMap;
+
+import org.eclipse.steady.kb.ImportCommand;
+import org.eclipse.steady.kb.Manager;
+import org.eclipse.steady.shared.util.StringUtil;
+import org.eclipse.steady.shared.util.VulasConfiguration;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * REST Controller for kb-importer
+ */
+@RestController
+@CrossOrigin("*")
+@RequestMapping("/import")
+public class ImportController {
+
+  private static Logger log = LoggerFactory.getLogger(ImportController.class);
+
+  /**
+   * The import thread that uses the {@link Manager} to pull and import statements.
+   */
+  private Thread importerThread = null;
+
+  /**
+   * Immport threads can be started and stopped using the respective endpoints.
+   */
+  private int threadsCreated = 0;
+
+  /**
+   * Used by the importer thread.
+   */
+  private final Manager manager = new Manager();
+
+  /**
+   * Default wait time between subsequent imports.
+   */
+  static final long waitTimeMs =
+      VulasConfiguration.getGlobal()
+          .getConfiguration()
+          .getLong("vulas.kb-importer.refetchAllMs", 86400000);
+
+  /**
+   * Creates a new importer thread.
+   * 
+   * @param _args
+   * @param _wait_time_ms
+   * @return
+   */
+  private final Thread createImporterThread(HashMap<String, Object> _args, Long _wait_time_ms) {
+    this.threadsCreated++;
+    Thread t = new Thread(
+      new Runnable() {
+        public void run() {
+          log.debug("Importer thread started");
+          try {
+            // Until InterruptException: Import and sleep
+            while (true) {
+              manager.start(_args);
+              log.info(
+                  "Waiting "
+                      + StringUtil.formatMinString(_wait_time_ms)
+                      + " until next execution...");
+              Thread.sleep(_wait_time_ms);
+            }
+          }
+          // Happens if the controller's start endpoint is called
+          catch (InterruptedException e) {
+            log.info("Thread [" + Thread.currentThread().getName() + "] interrupted");
+          }
+        }
+      },
+      "kb-importer-" + this.threadsCreated);
+    t.setPriority(Thread.MIN_PRIORITY);
+    return t;
+  }
+
+  /**
+   * Creates the controller and starts the importer thread with default
+   * configuration settings.
+   */
+  @Autowired
+  ImportController() {
+    // Create the thread with default config
+    HashMap<String, Object> args = new HashMap<String, Object>();
+    args.put(ImportCommand.OVERWRITE_OPTION, false);
+    args.put(ImportCommand.UPLOAD_CONSTRUCT_OPTION, false);
+    args.put(ImportCommand.VERBOSE_OPTION, false);
+    args.put(ImportCommand.SKIP_CLONE_OPTION, true);
+    this.importerThread = this.createImporterThread(args, waitTimeMs);
+    
+    // Start the thread
+    try {
+      this.importerThread.start();      
+    } catch (Exception e) {
+      log.error("Exception when starting importer thread: " + e.getMessage(), e);
+    }
+  }
+
+  /**
+   * Recreates the importer thread with the given configuration, unless an
+   * import is currently on-going.
+   *
+   * @param overwrite a boolean
+   * @param upload a boolean
+   * @param verbose a boolean
+   * @param skipClone a boolean
+   * @param waitTimeMs a long indicating the wait time between subsequent imports
+   * @return a {@link org.springframework.http.ResponseEntity} object
+   */
+  @RequestMapping(value = "/start", method = RequestMethod.POST)
+  public ResponseEntity<Boolean> start(
+      @RequestParam(defaultValue = "false") boolean overwrite,
+      @RequestParam(defaultValue = "false") boolean upload,
+      @RequestParam(defaultValue = "false") boolean verbose,
+      @RequestParam(defaultValue = "true") boolean skipClone,
+      @RequestParam(defaultValue = "86400000") long waitTimeMs) {
+    
+    // On-going import: don't do anything
+    if (this.manager.isRunningStart()) {
+      log.info("On-going import, no action is taken");
+      return new ResponseEntity<Boolean>(false, HttpStatus.OK);
+    }
+
+    // No on-going import: interrupt and re-create thread (with potentially different configuration)
+    try {
+      log.info("No on-going import, re-create importer thread with given configuration");
+      if (this.importerThread != null && this.importerThread.isAlive()) {
+        this.importerThread.interrupt();
+      }
+
+      // Create the thread with given config
+      HashMap<String, Object> args = new HashMap<String, Object>();
+      args.put(ImportCommand.OVERWRITE_OPTION, overwrite);
+      args.put(ImportCommand.UPLOAD_CONSTRUCT_OPTION, upload);
+      args.put(ImportCommand.VERBOSE_OPTION, verbose);
+      args.put(ImportCommand.SKIP_CLONE_OPTION, skipClone);
+      long time_to_wait_ms = waitTimeMs != 0 ? waitTimeMs : waitTimeMs;
+      this.importerThread = this.createImporterThread(args, time_to_wait_ms);
+
+      // Start the thread
+      this.importerThread.start();
+      return new ResponseEntity<Boolean>(true, HttpStatus.OK);
+    } catch (Exception e) {
+      log.error("Exception when starting importer thread: " + e.getMessage(), e);
+      return new ResponseEntity<Boolean>(false, HttpStatus.INTERNAL_SERVER_ERROR);
+    }
+  }
+
+  /**
+   * Stops the import and interrupts the importer thread.
+   *
+   * @return a {@link org.springframework.http.ResponseEntity} object
+   */
+  @RequestMapping(value = "/stop", method = RequestMethod.POST)
+  public ResponseEntity<Boolean> stop() {
+    boolean stopped = false;
+    try {
+      if (this.manager.isRunningStart()
+          || (this.importerThread != null && this.importerThread.isAlive())) {
+        stopped = true;
+        this.manager.stop();
+        this.importerThread.interrupt();
+        log.info("Importer thread stopped");
+      } else {
+        log.info("Importer thread not running");
+      }
+      return new ResponseEntity<Boolean>(stopped, HttpStatus.OK);
+    } catch (Exception e) {
+      log.error("Exception when stopping importer thread: " + e.getMessage(), e);
+      return new ResponseEntity<Boolean>(stopped, HttpStatus.INTERNAL_SERVER_ERROR);
+    }
+  }
+
+  /**
+   * Imports a single vulnerability whose statement.yaml is expected to be in
+   * the correct folder.
+   *
+   * @param id a {@link java.lang.String} object
+   * @param overwrite a boolean
+   * @param upload a boolean
+   * @param verbose a boolean
+   * @param skipClone a boolean
+   * @return a {@link org.springframework.http.ResponseEntity} object
+   */
+  @RequestMapping(value = "/start/{id}", method = RequestMethod.POST)
+  public ResponseEntity<Boolean> importSingleVuln(
+      @PathVariable String id,
+      @RequestParam(defaultValue = "false") boolean overwrite,
+      @RequestParam(defaultValue = "false") boolean upload,
+      @RequestParam(defaultValue = "false") boolean verbose,
+      @RequestParam(defaultValue = "true") boolean skipClone) {
+
+    try {
+      if (this.manager.isRunningStart()) {
+        log.info("Importer thread already running");
+        return new ResponseEntity<Boolean>(false, HttpStatus.SERVICE_UNAVAILABLE);
+      } else {
+        HashMap<String, Object> args = new HashMap<String, Object>();
+        args.put(ImportCommand.OVERWRITE_OPTION, overwrite);
+        args.put(ImportCommand.UPLOAD_CONSTRUCT_OPTION, upload);
+        args.put(ImportCommand.VERBOSE_OPTION, verbose);
+        args.put(ImportCommand.SKIP_CLONE_OPTION, skipClone);
+        manager.importSingleVuln(args, id);
+        return new ResponseEntity<Boolean>(true, HttpStatus.OK);
+      }
+    } catch (Exception e) {
+      log.error("Exception when importing vulnerability: " + e.getMessage(), e);
+      return new ResponseEntity<Boolean>(false, HttpStatus.INTERNAL_SERVER_ERROR);
+    }
+  }
+
+  /**
+   * <p>status.</p>
+   *
+   * @return a {@link java.lang.String} object
+   */
+  @GetMapping("/status")
+  public String status() {
+    return manager.status();
+  }
+
+  /**
+   * <p>statusSingleVuln.</p>
+   *
+   * @param id a {@link java.lang.String} object
+   * @return a {@link java.lang.String} object
+   */
+  @GetMapping(value = "/status/{id}")
+  public String statusSingleVuln(@PathVariable String id) {
+    String statusStr = manager.getVulnStatus(id).toString();
+    if (statusStr == null) {
+      return "Vulnerability not found";
+    } else return statusStr;
+  }
+}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/rest/MainController.java b/kb-importer/src/main/java/org/eclipse/steady/kb/rest/MainController.java
new file mode 100644
index 000000000..f337181f2
--- /dev/null
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/rest/MainController.java
@@ -0,0 +1,63 @@
+/**
+ * This file is part of Eclipse Steady.java
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+ */
+package org.eclipse.steady.kb.rest;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration;
+import org.springframework.boot.builder.SpringApplicationBuilder;
+import org.springframework.boot.web.servlet.support.SpringBootServletInitializer;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.Configuration;
+
+/**
+ * <p>MainController class.</p>
+ */
+@Configuration
+@ComponentScan({"org.eclipse.steady.kb.rest"})
+@EnableAutoConfiguration
+@SpringBootApplication(exclude = {DataSourceAutoConfiguration.class})
+public class MainController extends SpringBootServletInitializer {
+
+  /**
+   * <p>backendApi.</p>
+   *
+   * @return a {@link org.springdoc.core.GroupedOpenApi} object.
+   */
+  // @Bean
+  // public GroupedOpenApi publicApi() {
+  //   return GroupedOpenApi.builder().setGroup("public").pathsToMatch("/**").build();
+  // }
+
+  /**
+   * <p>main.</p>
+   *
+   * @param args an array of {@link java.lang.String} objects.
+   */
+  public static void main(String[] args) {
+    SpringApplication.run(MainController.class, args);
+  }
+
+  /** {@inheritDoc} */
+  @Override
+  protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
+    return application.sources(MainController.class);
+  }
+}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/task/ExtractOrClone.java b/kb-importer/src/main/java/org/eclipse/steady/kb/task/ExtractOrClone.java
new file mode 100644
index 000000000..7734eeef6
--- /dev/null
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/task/ExtractOrClone.java
@@ -0,0 +1,352 @@
+/**
+ * This file is part of Eclipse Steady.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+ */
+package org.eclipse.steady.kb.task;
+
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.HashMap;
+import java.util.List;
+
+import org.apache.logging.log4j.Logger;
+import org.eclipse.steady.kb.ImportCommand;
+import org.eclipse.steady.kb.Manager;
+import org.eclipse.steady.kb.model.Commit;
+import org.eclipse.steady.kb.model.Vulnerability;
+import org.eclipse.steady.kb.util.Metadata;
+import org.eclipse.steady.shared.util.FileUtil;
+
+/**
+ * Obtain modified source code files for each commit in a statement.
+ * These files are obtained by extracting from a tar file (if available) or directly from the repository.
+ */
+public class ExtractOrClone {
+
+  private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
+
+  private static final String GIT_DIRECTORY = "git-repos";
+  private final Manager manager;
+  private final Vulnerability vuln;
+  private final String vulnId;
+  private final String dirPath;
+  private final File tarFile;
+  private final boolean skipClone;
+
+  /**
+   * <p>Constructor for ExtractOrClone.</p>
+   *
+   * @param manager a {@link org.eclipse.steady.kb.Manager} object
+   * @param vuln a {@link org.eclipse.steady.kb.model.Vulnerability} object
+   * @param dir a {@link java.io.File} object
+   * @param skipClone a boolean
+   */
+  public ExtractOrClone(Manager manager, Vulnerability vuln, File dir, boolean skipClone) {
+    this.manager = manager;
+    this.vuln = vuln;
+    this.vulnId = vuln.getVulnId();
+    this.dirPath = dir.getPath();
+    this.tarFile = getTarFile(dirPath);
+    this.skipClone = skipClone;
+  }
+
+  /**
+   * Extracts the tarball associated to a given vulnerability (if any). If no
+   * tarball is present, the repo will be cloned and the fix commits be pulled
+   * (since that is expensive, the configuration setting skipClone can alter
+   * this behavior).
+   */
+  public void execute() {
+    // Extract tarball
+    if (tarFile != null) {
+      manager.setVulnStatus(this.vulnId, Manager.VulnStatus.EXTRACTING);
+      extract(tarFile, dirPath);
+      log.info("Vulnerability [" + this.vulnId + "]: Extracted tarball to [" + dirPath + "]");
+    }
+    // Clone (depending on the configuration)
+    else {
+      List<Commit> commits = vuln.getCommits();
+      if (commits == null || commits.size() == 0) {
+        log.warn("Vulnerability [" + this.vulnId + "]: Neither tarball nor commits available");
+      } else if (this.skipClone) {
+        log.info("Vulnerability [" + this.vulnId + "]: Cloning skipped");
+        manager.setVulnStatus(this.vulnId, Manager.VulnStatus.SKIP_CLONE);
+      } else {
+        log.info("Vulnerability [" + this.vulnId + "]: Cloning...");
+        manager.setVulnStatus(this.vulnId, Manager.VulnStatus.CLONING);
+        clone(vuln, dirPath);
+      }
+    } 
+  }
+
+  /**
+   * <p>Getter for the field <code>tarFile</code>.</p>
+   *
+   * @param dirPath a {@link java.lang.String} object
+   * @return a {@link java.io.File} object
+   */
+  public File getTarFile(String dirPath) {
+    if (FileUtil.isAccessibleFile(dirPath + File.separator + ImportCommand.SOURCE_TAR)) {
+      return new File(dirPath + File.separator + ImportCommand.SOURCE_TAR);
+    } else {
+      return null;
+    }
+  }
+
+  /**
+   * <p>extract.</p>
+   *
+   * @param tarFile a {@link java.io.File} object
+   * @param dirPath a {@link java.lang.String} object
+   */
+  public void extract(File tarFile, String dirPath) {
+    String extractCommand = "tar -xf " + tarFile.getPath() + " --directory " + dirPath;
+    try {
+      Process process = Runtime.getRuntime().exec(extractCommand);
+      process.waitFor();
+      List<Commit> commits = vuln.getCommits();
+      for (Commit commit : commits) {
+        String commitDirPath = dirPath + File.separator + commit.getCommitId();
+        createAndWriteCommitMetadata(commit, null, commitDirPath);
+      }
+    } catch (IOException | InterruptedException e) {
+      String vulnId = dirPath.split(File.separator)[dirPath.split(File.separator).length - 1];
+      manager.setVulnStatus(vulnId, Manager.VulnStatus.FAILED_EXTRACT_OR_CLONE);
+      manager.addFailure(vuln.getVulnId(), e);
+      log.error(e.getMessage(), e);
+    }
+  }
+
+  /**
+   * <p>clone.</p>
+   *
+   * @param vuln a {@link org.eclipse.steady.kb.model.Vulnerability} object
+   * @param dirPath a {@link java.lang.String} object
+   */
+  public void clone(Vulnerability vuln, String dirPath) {
+    // Loop all commits
+    for (Commit commit : vuln.getCommits()) {
+
+      // Create dir for commit which will hold the before/after Java files
+      String repoUrl = commit.getRepoUrl();
+      String commitId = commit.getCommitId();
+      String commitDirPath = dirPath + File.separator + commitId;
+      File commitDir = new File(commitDirPath);
+      commitDir.mkdir();
+
+      String repoDirPath =
+          dirPath
+              + File.separator
+              + GIT_DIRECTORY
+              + File.separator
+              + repoUrl.replace("https://", "").replace("/", "_");
+
+      // Create lock to avoid multiple threads interacting with the same clone
+      manager.lockRepo(repoUrl);
+
+      try {
+        cloneOnce(repoUrl, repoDirPath);
+        createAndWriteCommitMetadata(commit, repoDirPath, commitDirPath);
+        writeCommitDiff(commitId, repoDirPath, commitDirPath);
+      } catch (IOException | InterruptedException e) {
+        manager.setVulnStatus(vuln.getVulnId(), Manager.VulnStatus.FAILED_EXTRACT_OR_CLONE);
+        manager.addFailure(vuln.getVulnId(), e);
+        log.error(e.getMessage());
+        break;
+      }
+
+      // Unlock
+      manager.unlockRepo(repoUrl);
+    }
+  }
+
+  /**
+   * <p>createAndWriteCommitMetadata.</p>
+   *
+   * @param commit a {@link org.eclipse.steady.kb.model.Commit} object
+   * @param repoDirPath a {@link java.lang.String} object
+   * @param commitDirPath a {@link java.lang.String} object
+   * @throws java.io.IOException if any.
+   */
+  public void createAndWriteCommitMetadata(Commit commit, String repoDirPath, String commitDirPath)
+      throws IOException {
+
+    String commitId = commit.getCommitId();
+    HashMap<String, String> commitMetadata = new HashMap<String, String>();
+    String timestamp;
+
+    if (repoDirPath == null) {
+      Path timestampPath = Paths.get(commitDirPath + File.separator + "timestamp");
+      timestamp = new String(Files.readAllBytes(timestampPath)).replace("\n", "");
+    } else {
+      String gitShowCommand =
+          "git -C " + repoDirPath + " show --no-patch --no-notes --pretty='%at' " + commitId;
+      Process gitShow = Runtime.getRuntime().exec(gitShowCommand);
+
+      BufferedReader gitShowStdInput =
+          new BufferedReader(new InputStreamReader(gitShow.getInputStream()));
+      log.info("Executing: " + gitShowCommand);
+      try {
+        gitShow.waitFor();
+      } catch (InterruptedException e) {
+        return;
+      }
+      if ((timestamp = gitShowStdInput.readLine()) == null || timestamp == null) {
+        BufferedReader gitShowError =
+            new BufferedReader(new InputStreamReader(gitShow.getErrorStream()));
+        String repoUrl = commit.getRepoUrl();
+        log.error(
+            "Failed to get commit timestamp for repository " + repoUrl + " commit id " + commitId);
+        String error = gitShowError.readLine();
+        log.error("git show: " + error);
+        manager.setVulnStatus(vuln.getVulnId(), Manager.VulnStatus.FAILED_EXTRACT_OR_CLONE);
+        manager.addFailure(
+            vuln.getVulnId(),
+            new Exception(
+                "Failed to get commit timestamp for repository "
+                    + repoUrl
+                    + " commit id "
+                    + commitId));
+      }
+    }
+
+    commitMetadata.put("repository", commit.getRepoUrl());
+    commitMetadata.put("branch", commit.getBranch());
+    commitMetadata.put("timestamp", timestamp);
+    commitMetadata.put("commit_id", commitId);
+
+    Metadata.writeCommitMetadata(commitDirPath, commitMetadata);
+  }
+
+  /**
+   * Clones the given repo to the given directory (unless that directory already
+   * exists).
+   *
+   * @param repoUrl a {@link java.lang.String} object
+   * @param repoDirPath a {@link java.lang.String} object
+   * @throws java.io.IOException if any.
+   * @throws java.lang.InterruptedException if any.
+   */
+  public void cloneOnce(String repoUrl, String repoDirPath)
+      throws IOException, InterruptedException {
+    if (Files.exists(Paths.get(repoDirPath))) {
+      log.info("Folder [" + repoDirPath + "] already exists, git clone will be skipped");
+    } else {
+      log.info("Cloning repository [" + repoUrl + "] to [" + repoDirPath + "]...");
+      String gitCloneCommand = "git clone " + repoUrl + " " + repoDirPath;
+      Process gitClone = Runtime.getRuntime().exec(gitCloneCommand);
+      gitClone.waitFor();
+    }
+  }
+
+  /**
+   * <p>writeCommitDiff.</p>
+   *
+   * @param commitId a {@link java.lang.String} object
+   * @param repoDirPath a {@link java.lang.String} object
+   * @param commitDirPath a {@link java.lang.String} object
+   * @throws java.io.IOException if any.
+   * @throws java.lang.InterruptedException if any.
+   */
+  public void writeCommitDiff(String commitId, String repoDirPath, String commitDirPath)
+      throws IOException, InterruptedException {
+    String gitDiffCommand =
+        "git -C " + repoDirPath + " diff --name-only " + commitId + "^.." + commitId;
+    log.info("Executing: " + gitDiffCommand);
+    Process gitDiff = Runtime.getRuntime().exec(gitDiffCommand);
+    BufferedReader gitDiffStdInput =
+        new BufferedReader(new InputStreamReader(gitDiff.getInputStream()));
+
+    String filename;
+    while ((filename = gitDiffStdInput.readLine()) != null) {
+      execGitDiffFile(repoDirPath, commitId, filename, true);
+      execGitDiffFile(repoDirPath, commitId, filename, false);
+    }
+  }
+
+  /**
+   * <p>execGitDiffFile.</p>
+   *
+   * @param repoDirPath a {@link java.lang.String} object
+   * @param commitId a {@link java.lang.String} object
+   * @param filename a {@link java.lang.String} object
+   * @param before a boolean
+   * @throws java.io.IOException if any.
+   * @throws java.lang.InterruptedException if any.
+   */
+  public void execGitDiffFile(String repoDirPath, String commitId, String filename, boolean before)
+      throws IOException, InterruptedException {
+
+    String commitDirPath = dirPath + File.separator + commitId;
+    String commitStr;
+    if (before) {
+      commitStr = commitId + "~1:";
+    } else {
+      commitStr = commitId + ":";
+    }
+    String beforeOrAfter = before ? "before" : "after";
+    // for each file modified in the commit...
+    String gitCatCommand = "git -C " + repoDirPath + " cat-file -e " + commitStr + filename;
+    Process gitCat = Runtime.getRuntime().exec(gitCatCommand);
+    log.info("Executing: " + gitCatCommand);
+    BufferedReader gitCatErrorInput =
+        new BufferedReader(new InputStreamReader(gitCat.getErrorStream()));
+    gitCat.waitFor();
+
+    
+    if (gitCat.exitValue() == 0) {
+      String filepath = commitDirPath + File.separator + beforeOrAfter + File.separator + filename;
+      File file = new File(filepath);
+      File dir = file.getParentFile();
+      dir.mkdirs();
+
+      String diffFileCommand = "git -C " + repoDirPath + " show " + commitStr + filename;
+
+      log.info("Executing: " + diffFileCommand);
+      Process gitDiffFile = Runtime.getRuntime().exec(diffFileCommand);
+
+      writeCmdOutputToFile(gitDiffFile, filepath);
+
+      gitDiffFile.waitFor();
+    }
+  }
+
+  /**
+   * <p>writeCmdOutputToFile.</p>
+   *
+   * @param process a {@link java.lang.Process} object
+   * @param filepath a {@link java.lang.String} object
+   * @throws java.io.IOException if any.
+   */
+  public void writeCmdOutputToFile(Process process, String filepath) throws IOException {
+    BufferedReader stdInput = new BufferedReader(new InputStreamReader(process.getInputStream()));
+    String line;
+    String lines = "";
+    while ((line = stdInput.readLine()) != null) {
+      lines += line + "\n";
+    }
+    Path path = Paths.get(filepath);
+    byte[] bytes = lines.getBytes();
+
+    Files.write(path, bytes);
+  }
+}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/task/ImportAffectedLibraries.java b/kb-importer/src/main/java/org/eclipse/steady/kb/task/ImportAffectedLibraries.java
index 9a047bb84..8350b255d 100755
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/task/ImportAffectedLibraries.java
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/task/ImportAffectedLibraries.java
@@ -18,21 +18,24 @@
  */
 package org.eclipse.steady.kb.task;
 
+import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
+
 import org.apache.logging.log4j.Logger;
 import org.eclipse.steady.backend.BackendConnectionException;
 import org.eclipse.steady.backend.BackendConnector;
-import org.eclipse.steady.kb.command.Command;
+import org.eclipse.steady.kb.ImportCommand;
 import org.eclipse.steady.kb.model.Artifact;
 import org.eclipse.steady.kb.model.Vulnerability;
 import org.eclipse.steady.shared.enums.AffectedVersionSource;
 import org.eclipse.steady.shared.json.model.AffectedConstructChange;
 import org.eclipse.steady.shared.json.model.AffectedLibrary;
 import org.eclipse.steady.shared.json.model.LibraryId;
+
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.github.packageurl.MalformedPackageURLException;
@@ -45,17 +48,24 @@
  * </p>
  */
 public class ImportAffectedLibraries implements Task {
-  private static final String OVERWRITE_OPTION = "o";
+
   private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
 
   /** {@inheritDoc} */
   public void execute(
       Vulnerability vuln, HashMap<String, Object> args, BackendConnector backendConnector)
-      throws MalformedPackageURLException, BackendConnectionException, JsonProcessingException {
+      throws MalformedPackageURLException, BackendConnectionException, JsonProcessingException,
+          IOException {
+
+    log.info("Initiating ImportAffectedLibraries for vulnerability " + vuln.getVulnId());
+
     List<Artifact> artifacts = vuln.getArtifacts();
     if (artifacts == null || artifacts.isEmpty()) {
       return;
     }
+    if (args.containsKey(ImportCommand.DELETE) && (boolean) args.get(ImportCommand.DELETE)) {
+      backendConnector.deletePatchEvalResults(vuln.getVulnId(), AffectedVersionSource.KAYBEE);
+    }
 
     List<AffectedLibrary> affectedLibsToUpsert = new ArrayList<AffectedLibrary>();
     HashSet<org.eclipse.steady.shared.json.model.Artifact> ciaArtifactsCache = new HashSet<>();
@@ -71,7 +81,7 @@ public void execute(
               vuln.getVulnId(), purlGroup, purlArtifact, purlVersion, AffectedVersionSource.KAYBEE);
       if (affectedLibs != null && affectedLibs.length > 0) {
         AffectedLibrary affectedLibrary = affectedLibs[0];
-        Boolean overwrite = (Boolean) args.get(OVERWRITE_OPTION);
+        Boolean overwrite = (Boolean) args.get(ImportCommand.OVERWRITE_OPTION);
         if (overwrite || affectedLibrary.getAffected() == null) {
           setAfftectedLib(artifact, affectedLibrary);
           affectedLibsToUpsert.add(affectedLibrary);
@@ -125,6 +135,8 @@ public void execute(
       backendConnector.uploadBugAffectedLibraries(
           null, vuln.getVulnId(), json, AffectedVersionSource.KAYBEE);
     }
+
+    log.info("ImportAffectedLibraries: " + vuln.getVulnId() + " complete");
   }
 
   private void setAfftectedLib(Artifact artifact, AffectedLibrary affectedLibrary) {
@@ -133,10 +145,4 @@ private void setAfftectedLib(Artifact artifact, AffectedLibrary affectedLibrary)
     affectedLibrary.setAffectedcc(Collections.<AffectedConstructChange>emptyList());
     affectedLibrary.setSource(AffectedVersionSource.KAYBEE);
   }
-
-  /** {@inheritDoc} */
-  @Override
-  public Command.NAME getCommandName() {
-    return Command.NAME.IMPORT;
-  }
 }
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/task/ImportVulnerability.java b/kb-importer/src/main/java/org/eclipse/steady/kb/task/ImportVulnerability.java
index afc612fa7..bc439e1eb 100755
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/task/ImportVulnerability.java
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/task/ImportVulnerability.java
@@ -29,15 +29,11 @@
 import java.util.Map;
 import java.util.Set;
 
-import com.google.gson.JsonSyntaxException;
-import com.jayway.jsonpath.Configuration;
-import com.jayway.jsonpath.JsonPath;
-
 import org.apache.logging.log4j.Logger;
 import org.eclipse.steady.ConstructChange;
 import org.eclipse.steady.backend.BackendConnectionException;
 import org.eclipse.steady.backend.BackendConnector;
-import org.eclipse.steady.kb.command.Command;
+import org.eclipse.steady.kb.ImportCommand;
 import org.eclipse.steady.kb.model.Commit;
 import org.eclipse.steady.kb.model.Note;
 import org.eclipse.steady.kb.model.Vulnerability;
@@ -47,34 +43,28 @@
 import org.eclipse.steady.shared.enums.ContentMaturityLevel;
 import org.eclipse.steady.shared.json.JsonBuilder;
 
+import com.google.gson.JsonSyntaxException;
+import com.jayway.jsonpath.Configuration;
+import com.jayway.jsonpath.JsonPath;
+
 import net.minidev.json.JSONObject;
 
 /**
  * <p>ImportVulnerability class.</p>
  */
 public class ImportVulnerability implements Task {
-  private static final String OVERWRITE_OPTION = "o";
-  private static final String DIRECTORY_OPTION = "d";
-  private static final String VERBOSE_OPTION = "v";
 
   private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
-  private BackendConnector backendConnector = null;
 
   /** {@inheritDoc} */
   public void execute(
       Vulnerability vuln, HashMap<String, Object> args, BackendConnector _backendConnector)
       throws BackendConnectionException, JsonSyntaxException, IOException {
     String vulnId = vuln.getVulnId();
-    this.backendConnector = _backendConnector;
-
-    Boolean overwrite = (Boolean) args.get(OVERWRITE_OPTION);
-    if (!overwrite && getBackendConnector().isBugExisting(vulnId)) {
-      log.info("Bug [{}] already exists in backend, analysis will be skipped", vulnId);
-      return;
-    }
+    //log.info("Initiating ImportVulnerability: " + vulnId);
 
     List<Commit> commits = new ArrayList<Commit>();
-    File file = new File((String) args.get(DIRECTORY_OPTION));
+    File file = new File((String) args.get(ImportCommand.DIRECTORY_OPTION));
 
     File commitDirs[] =
         file.listFiles(
@@ -86,12 +76,15 @@ public boolean accept(File file) {
             });
 
     for (File commitDir : commitDirs) {
-      String dir = commitDir.getAbsolutePath();
-      Commit commit = null;
-      commit = Metadata.getCommitMetadata(dir);
 
-      if (commit != null) {
-        commits.add(commit);
+      if (commitDir.isDirectory()) {
+        String dir = commitDir.getAbsolutePath();
+        Commit commit = null;
+        commit = Metadata.getCommitMetadata(dir);
+
+        if (commit != null) {
+          commits.add(commit);
+        }
       }
     }
 
@@ -99,7 +92,8 @@ public boolean accept(File file) {
     Map<String, Set<ConstructChange>> allChanges = new HashMap<String, Set<ConstructChange>>();
     for (Commit commit : commits) {
       changes = ConstructSet.identifyConstructChanges(commit, allChanges);
-      if ((Boolean) args.get(VERBOSE_OPTION)) {
+      if (args.containsKey(ImportCommand.VERBOSE_OPTION)
+          && (Boolean) args.get(ImportCommand.VERBOSE_OPTION)) {
         for (ConstructChange chg : changes) {
           log.info(chg.toString());
         }
@@ -215,7 +209,7 @@ private String getCVEDescription(Vulnerability _vulnerability) {
     String cveString;
     String vulnId = _vulnerability.getVulnId();
     try {
-      cveString = getBackendConnector().getCVE(vulnId);
+      cveString = BackendConnector.getInstance().getCVE(vulnId);
     } catch (BackendConnectionException e) {
       log.error("Error connecting to NVD service. {}", e.getCause(), e);
       return null;
@@ -236,14 +230,4 @@ private String getCVEDescription(Vulnerability _vulnerability) {
     }
     return summary;
   }
-
-  /** {@inheritDoc} */
-  @Override
-  public Command.NAME getCommandName() {
-    return Command.NAME.IMPORT;
-  }
-
-  private BackendConnector getBackendConnector() {
-    return backendConnector;
-  }
 }
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/task/Task.java b/kb-importer/src/main/java/org/eclipse/steady/kb/task/Task.java
index f111fc93c..367ba72fd 100644
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/task/Task.java
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/task/Task.java
@@ -2,20 +2,12 @@
 
 import java.util.HashMap;
 import org.eclipse.steady.backend.BackendConnector;
-import org.eclipse.steady.kb.command.Command;
 import org.eclipse.steady.kb.model.Vulnerability;
 
 /**
  * Execute Command tasks
  */
 public interface Task {
-  /**
-   * command name the task belongs to
-   *
-   * @return name of command
-   */
-  Command.NAME getCommandName();
-
   /**
    * Task Executor
    *
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/task/TaskProvider.java b/kb-importer/src/main/java/org/eclipse/steady/kb/task/TaskProvider.java
deleted file mode 100644
index 857a227c4..000000000
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/task/TaskProvider.java
+++ /dev/null
@@ -1,51 +0,0 @@
-package org.eclipse.steady.kb.task;
-
-import java.util.ArrayList;
-import java.util.Iterator;
-import java.util.List;
-import java.util.ServiceLoader;
-import org.eclipse.steady.kb.command.Command;
-
-/**
- * <p>TaskProvider class.</p>
- */
-public class TaskProvider {
-  private static TaskProvider instance = null;
-  private static List<Task> importTasks = new ArrayList<Task>();
-
-  private TaskProvider() {}
-
-  /**
-   * <p>Getter for the field <code>instance</code>.</p>
-   *
-   * @return a {@link org.eclipse.steady.kb.task.TaskProvider} object
-   */
-  public static synchronized TaskProvider getInstance() {
-    if (instance == null) {
-      return new TaskProvider();
-    }
-    return instance;
-  }
-
-  /**
-   * <p>getTasks.</p>
-   *
-   * @param commandName a {@link org.eclipse.steady.kb.command.Command.NAME} object
-   * @return a {@link java.util.List} object
-   */
-  public List<Task> getTasks(Command.NAME commandName) {
-    if (!importTasks.isEmpty()) {
-      return importTasks;
-    }
-
-    ServiceLoader<Task> serviceProviders = ServiceLoader.load(Task.class);
-    Iterator<Task> iterator = serviceProviders.iterator();
-    while (iterator.hasNext()) {
-      Task task = iterator.next();
-      if (task.getCommandName().equals(Command.NAME.IMPORT)) {
-        importTasks.add(task);
-      }
-    }
-    return importTasks;
-  }
-}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/util/Metadata.java b/kb-importer/src/main/java/org/eclipse/steady/kb/util/Metadata.java
index 2b0ed8c92..d12fc7918 100755
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/util/Metadata.java
+++ b/kb-importer/src/main/java/org/eclipse/steady/kb/util/Metadata.java
@@ -19,28 +19,41 @@
 package org.eclipse.steady.kb.util;
 
 import java.io.File;
+import java.io.FileWriter;
 import java.io.IOException;
-
-import com.google.gson.Gson;
-import com.google.gson.JsonSyntaxException;
+import java.io.Writer;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
 
 import org.apache.commons.lang.StringUtils;
 import org.apache.logging.log4j.Logger;
+import org.eclipse.steady.kb.model.Artifact;
 import org.eclipse.steady.kb.model.Commit;
+import org.eclipse.steady.kb.model.Note;
 import org.eclipse.steady.kb.model.Vulnerability;
 import org.eclipse.steady.shared.util.FileUtil;
+import org.yaml.snakeyaml.Yaml;
+
+import com.google.gson.Gson;
+import com.google.gson.JsonSyntaxException;
 
 /**
- * Metadata
+ * Helper methods to work with information provided in files statements.yaml and
+ * metadata.json.
  */
 public class Metadata {
 
-  private static final String META_PROPERTIES_FILE = "metadata.json";
-
   private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
 
+  private static final String METADATA_JSON = "metadata.json";
+
   /**
-   * read commit information from meta file
+   * Read commit information from metadata.json contained in the given dir.
    *
    * @param commitDir a {@link java.lang.String} object.
    * @return _commit a {@link org.eclipse.steady.kb.model.Commit} object.
@@ -48,15 +61,11 @@ public class Metadata {
    * @throws com.google.gson.JsonSyntaxException if any.
    */
   public static Commit getCommitMetadata(String commitDir) throws JsonSyntaxException, IOException {
-    String filePath = commitDir + File.separator + META_PROPERTIES_FILE;
+    String filePath = commitDir + File.separator + METADATA_JSON;
     if (!FileUtil.isAccessibleFile(filePath)) {
-      log.error(
-          "The commit folder {} or the meta file is missing {} in commit folder",
-          commitDir,
-          filePath);
+      log.error("File [" + filePath + "] cannot be read");
       return null;
     }
-
     Gson gson = new Gson();
     Commit metadata = null;
     metadata = gson.fromJson(FileUtil.readFile(filePath), Commit.class);
@@ -65,20 +74,37 @@ public static Commit getCommitMetadata(String commitDir) throws JsonSyntaxExcept
   }
 
   /**
-   * read vulnerability information from meta file
+   * Write commit information to metadata.json in the given dir.
    *
-   * @param rootDir a {@link java.lang.String} object.
+   * @param commitDir a {@link java.lang.String} object
+   * @param commitMetadata a {@link java.util.HashMap} object
+   * @throws java.io.IOException if any.
+   */
+  public static void writeCommitMetadata(String commitDir, HashMap<String, String> commitMetadata)
+      throws IOException {
+    String filePath = commitDir + File.separator + METADATA_JSON;
+    File file = new File(filePath);
+    file.createNewFile();
+    Writer writer = new FileWriter(filePath, false);
+    new Gson().toJson(commitMetadata, writer);
+    writer.close();
+  }
+
+  /**
+   * Creates a {@link Vulnerability} from the information provided in metadata.json in the given directory.
+   *
+   * @param _dir a {@link java.lang.String} object.
    * @return _commit a {@link org.eclipse.steady.kb.model.Vulnerability} object.
    * @throws java.io.IOException if any.
    * @throws com.google.gson.JsonSyntaxException if any.
    */
-  public static Vulnerability getVulnerabilityMetadata(String rootDir)
+  public static Vulnerability getFromMetadata(String _dir)
       throws JsonSyntaxException, IOException {
-    String filePath = rootDir + File.separator + META_PROPERTIES_FILE;
+    String filePath = _dir + File.separator + METADATA_JSON;
     if (!FileUtil.isAccessibleFile(filePath)) {
       throw new IllegalArgumentException(
           "The root folder "
-              + rootDir
+              + _dir
               + "  or the meta file in root directory is missing "
               + filePath);
     }
@@ -94,4 +120,81 @@ public static Vulnerability getVulnerabilityMetadata(String rootDir)
 
     return metadata;
   }
+
+  /**
+   * Creates a {@link Vulnerability} from the information provided in the given
+   * statement.
+   *
+   * @param _yaml_file a {@link java.lang.String} object
+   * @return a {@link org.eclipse.steady.kb.model.Vulnerability} object
+   * @throws java.io.IOException if any.
+   */
+  public static Vulnerability getFromYaml(String _yaml_file) throws IOException {
+
+    Path metadataPath = Paths.get(_yaml_file);
+    Yaml yaml = new Yaml();
+
+    String metadataString = new String(Files.readAllBytes(metadataPath));
+
+    Map<String, Object> vulnerabilityMap = yaml.load(metadataString);
+
+    Vulnerability vulnerability = new Vulnerability();
+
+    vulnerability.setVulnId((String) vulnerabilityMap.get("vulnerability_id"));
+
+    if (vulnerabilityMap.containsKey("notes")) {
+      List<HashMap<String, Object>> notesMaps =
+          (List<HashMap<String, Object>>) vulnerabilityMap.get("notes");
+      List<Note> notes = new ArrayList<Note>();
+      for (HashMap<String, Object> noteMap : notesMaps) {
+        Note note = new Note();
+        note.setText((String) noteMap.get("text"));
+        List<String> links = (List<String>) noteMap.get("links");
+        note.setLinks(links);
+        notes.add(note);
+      }
+      vulnerability.setNotes(notes);
+    }
+
+    if (vulnerabilityMap.containsKey("artifacts")) {
+      List<HashMap<String, Object>> artifactsMaps =
+          (List<HashMap<String, Object>>) vulnerabilityMap.get("artifacts");
+      List<Artifact> artifacts = new ArrayList<Artifact>();
+      for (HashMap<String, Object> artifactMap : artifactsMaps) {
+        Artifact artifact = new Artifact();
+        artifact.setId((String) artifactMap.get("id"));
+        artifact.setReason((String) artifactMap.get("reason"));
+        artifact.setAffected((Boolean) artifactMap.get("affected"));
+        artifacts.add(artifact);
+      }
+      vulnerability.setArtifacts(artifacts);
+    }
+
+    if (vulnerabilityMap.containsKey("aliases")) {
+      List<String> aliases = (List<String>) vulnerabilityMap.get("aliases");
+      vulnerability.setAliases(aliases);
+    }
+
+    List<Commit> commitList = new ArrayList<Commit>();
+    if (vulnerabilityMap.containsKey("fixes")) {
+      List<HashMap<String, Object>> fixes =
+          (List<HashMap<String, Object>>) vulnerabilityMap.get("fixes");
+      for (HashMap<String, Object> fix : fixes) {
+        String branch = fix.get("id").toString();
+        List<HashMap<String, String>> commits = (List<HashMap<String, String>>) fix.get("commits");
+        for (HashMap<String, String> commitMap : commits) {
+          Commit commit = new Commit();
+          String repository = commitMap.get("repository");
+          String commitId = commitMap.get("id");
+          commit.setRepoUrl(repository);
+          commit.setCommitId(commitId);
+          commit.setBranch(branch);
+          commitList.add(commit);
+        }
+      }
+      vulnerability.setCommits(commitList);
+    }
+
+    return vulnerability;
+  }
 }
diff --git a/kb-importer/src/main/resources/META-INF/services/org.eclipse.steady.kb.command.Command b/kb-importer/src/main/resources/META-INF/services/org.eclipse.steady.kb.command.Command
deleted file mode 100644
index d15cf97bf..000000000
--- a/kb-importer/src/main/resources/META-INF/services/org.eclipse.steady.kb.command.Command
+++ /dev/null
@@ -1,3 +0,0 @@
-org.eclipse.steady.kb.command.Import
-org.eclipse.steady.kb.command.Help
-org.eclipse.steady.kb.command.Version
\ No newline at end of file
diff --git a/kb-importer/src/main/resources/META-INF/services/org.eclipse.steady.kb.task.Task b/kb-importer/src/main/resources/META-INF/services/org.eclipse.steady.kb.task.Task
deleted file mode 100644
index 6925cbda3..000000000
--- a/kb-importer/src/main/resources/META-INF/services/org.eclipse.steady.kb.task.Task
+++ /dev/null
@@ -1,2 +0,0 @@
-org.eclipse.steady.kb.task.ImportVulnerability
-org.eclipse.steady.kb.task.ImportAffectedLibraries
\ No newline at end of file
diff --git a/kb-importer/src/main/resources/application.properties b/kb-importer/src/main/resources/application.properties
new file mode 100644
index 000000000..7d8407651
--- /dev/null
+++ b/kb-importer/src/main/resources/application.properties
@@ -0,0 +1,37 @@
+#
+# This file is part of Eclipse Steady.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+#
+
+#spring.profiles.active=standalone
+
+#configurations ignored when the application is run as war (mvn profile container)
+server.servlet.context-path=/kb-importer
+server.port = 8080
+
+server.error.include-exception=true
+server.error.include-stacktrace=always
+
+# Settings for Actuator trace
+#
+# See
+#   https://github.com/spring-projects/spring-boot/blob/v1.5.2.RELEASE/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/trace/TraceProperties.java
+#   https://www.dontpanicblog.co.uk/2017/04/14/spring-boot-actuator-trace/
+#spring.jackson.date-format=yyyy-MM-dd HH:mm:ss
+# in spring 1.5.x config was management.trace.include=REQUEST_HEADERS, RESPONSE_HEADERS, ERRORS, QUERY_STRING
+# spring 2.x enums valid values:  AUTHORIZATION_HEADER,COOKIE_HEADERS,PRINCIPAL,REMOTE_ADDRESS,REQUEST_HEADERS,RESPONSE_HEADERS,SESSION_ID,TIME_TAKEN
+management.trace.http.include=REQUEST_HEADERS,RESPONSE_HEADERS
diff --git a/kb-importer/src/main/resources/steady-kb-importer.properties b/kb-importer/src/main/resources/steady-kb-importer.properties
new file mode 100644
index 000000000..88b892459
--- /dev/null
+++ b/kb-importer/src/main/resources/steady-kb-importer.properties
@@ -0,0 +1,34 @@
+
+#
+# This file is part of Eclipse Steady.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+# SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+#
+
+# Wait time between two subsequent imports (in milliseconds)
+# Default: 86400000 (= 1 day)
+vulas.kb-importer.refetchAllMs = 86400000
+
+# Path to kaybee binary
+# Default: Path within the Docker container (see ./docker/kb-importer/Dockerfile) 
+vulas.kb-importer.kaybeeBinaryPath = /kb-importer/kaybee
+
+# Path to kaybee configuration file
+# Default: Path within the Docker container (see ./docker/kb-importer/run.sh)
+vulas.kb-importer.kaybeeConfPath = ./conf/kaybeeconf.yaml
+
+# Path where kaybee's statements folder will be copied to
+vulas.kb-importer.statementsPath = /kb-importer/data/statements
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/MainTest.java b/kb-importer/src/test/java/org/eclipse/steady/kb/MainTest.java
deleted file mode 100755
index 379a3c4b5..000000000
--- a/kb-importer/src/test/java/org/eclipse/steady/kb/MainTest.java
+++ /dev/null
@@ -1,37 +0,0 @@
-/**
- * This file is part of Eclipse Steady.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
- */
-package org.eclipse.steady.kb;
-
-import org.junit.Test;
-
-public class MainTest {
-  private static final String SPACE = " ";
-
-  @Test
-  public void testHelp() {
-    String args = "help";
-    Main.main(args.split(SPACE));
-  }
-
-  @Test
-  public void testVersion() {
-    String args = "version";
-    Main.main(args.split(SPACE));
-  }
-}
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/TestConstructs.java b/kb-importer/src/test/java/org/eclipse/steady/kb/TestConstructs.java
old mode 100755
new mode 100644
index 73d50412c..2e8ada67d
--- a/kb-importer/src/test/java/org/eclipse/steady/kb/TestConstructs.java
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/TestConstructs.java
@@ -50,7 +50,7 @@ public void setup() {
   }
 
   @Test
-  public void testImport() {
+  public void testImportCommand() {
     Commit commit = new Commit();
     commit.setBranch("master");
     commit.setCommitId("b2b8f4adc557e4ef1ee2fe5e0ab46866c06ec55b");
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/TestImportCommand.java b/kb-importer/src/test/java/org/eclipse/steady/kb/TestImportCommand.java
new file mode 100644
index 000000000..78fb8a0d8
--- /dev/null
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/TestImportCommand.java
@@ -0,0 +1,68 @@
+/**
+ * This file is part of Eclipse Steady.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+ */
+package org.eclipse.steady.kb;
+
+import static org.junit.Assert.assertNull;
+
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.lang.reflect.Modifier;
+import java.util.HashMap;
+
+import org.eclipse.steady.backend.BackendConnectionException;
+import org.eclipse.steady.backend.BackendConnector;
+import org.eclipse.steady.kb.model.Vulnerability;
+import org.eclipse.steady.kb.task.MockBackConnector;
+import org.junit.Before;
+import org.junit.Test;
+
+import com.google.gson.JsonSyntaxException;
+
+public class TestImportCommand {
+
+  /**
+   * Enforce the use of {@link MockBackConnector}.
+   */
+  @Before
+  public void setup() {
+    try {
+      Field instance_field = BackendConnector.class.getDeclaredField("instance");
+      instance_field.setAccessible(true);
+      instance_field.set(null, new MockBackConnector());
+    } catch (NoSuchFieldException | SecurityException | IllegalArgumentException | IllegalAccessException e) {
+      e.printStackTrace();
+    }
+  }
+
+  @Test
+  public void testImportSkipExistingBug()
+      throws JsonSyntaxException, IOException, BackendConnectionException {
+    Vulnerability vuln = new Vulnerability();
+    vuln.setVulnId("CVE-TEST01");
+    MockBackConnector mockBackendConnector = new MockBackConnector();
+    HashMap<String, Object> args = new HashMap<String, Object>();
+    args.put(ImportCommand.OVERWRITE_OPTION, false);
+    args.put(ImportCommand.VERBOSE_OPTION, false);
+    args.put(ImportCommand.DIRECTORY_OPTION, "");
+    Manager manager = new Manager();
+    ImportCommand command = new ImportCommand(manager, args);
+    command.run();
+    assertNull(mockBackendConnector.getUploadJson());
+  }
+}
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/TestManager.java b/kb-importer/src/test/java/org/eclipse/steady/kb/TestManager.java
new file mode 100644
index 000000000..1f2bb7c89
--- /dev/null
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/TestManager.java
@@ -0,0 +1,70 @@
+/**
+ * This file is part of Eclipse Steady.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+ */
+package org.eclipse.steady.kb;
+
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+import java.util.List;
+
+import org.eclipse.steady.backend.BackendConnectionException;
+import org.eclipse.steady.backend.BackendConnector;
+import org.eclipse.steady.kb.task.MockBackConnector;
+import org.junit.Before;
+import org.junit.Test;
+
+import com.google.gson.JsonSyntaxException;
+
+public class TestManager {
+
+  /**
+   * Enforce the use of {@link MockBackConnector}.
+   */
+  @Before
+  public void setup() {
+    try {
+      Field instance_field = BackendConnector.class.getDeclaredField("instance");
+      instance_field.setAccessible(true);
+      instance_field.set(null, new MockBackConnector());
+    } catch (NoSuchFieldException | SecurityException | IllegalArgumentException | IllegalAccessException e) {
+      e.printStackTrace();
+    }
+  }
+
+  @Test
+  public void testStartList() throws JsonSyntaxException, IOException, BackendConnectionException {
+    String statementsPath = Manager.class.getClassLoader().getResource("statements").getPath();
+
+    HashMap<String, Object> args = new HashMap<String, Object>();
+    args.put(ImportCommand.OVERWRITE_OPTION, true);
+    args.put(ImportCommand.VERBOSE_OPTION, false);
+    args.put(ImportCommand.SKIP_CLONE_OPTION, false);
+
+    Manager manager = new Manager();
+
+    List<String> vulnIds = manager.identifyVulnerabilitiesToImport(statementsPath);
+    manager.startList(statementsPath, args, vulnIds);
+
+    Manager.VulnStatus vulnStatus1 = manager.getVulnStatus("CVE-2018-1270");
+
+    org.junit.Assert.assertEquals(vulnStatus1, Manager.VulnStatus.IMPORTED);
+    org.junit.Assert.assertEquals(((MockBackConnector)BackendConnector.getInstance()).getUploadedChangeLists().size(), 1);
+    org.junit.Assert.assertEquals(((MockBackConnector)BackendConnector.getInstance()).getUploadedLibraries().size(), 0);
+  }
+}
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/TestPythonConstructs.java b/kb-importer/src/test/java/org/eclipse/steady/kb/TestPythonConstructs.java
index 4d2a19058..b85bac440 100644
--- a/kb-importer/src/test/java/org/eclipse/steady/kb/TestPythonConstructs.java
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/TestPythonConstructs.java
@@ -50,7 +50,7 @@ public void setup() {
   }
 
   @Test
-  public void testImport() {
+  public void testImportCommand() {
     Commit commit = new Commit();
     commit.setBranch("master");
     commit.setCommitId("adbca5e4db42542575734b8e5d26961c8ada7265");
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/ZipUtil.java b/kb-importer/src/test/java/org/eclipse/steady/kb/ZipUtil.java
old mode 100755
new mode 100644
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/command/CommandParserTest.java b/kb-importer/src/test/java/org/eclipse/steady/kb/command/CommandParserTest.java
deleted file mode 100755
index 85b4abdaf..000000000
--- a/kb-importer/src/test/java/org/eclipse/steady/kb/command/CommandParserTest.java
+++ /dev/null
@@ -1,86 +0,0 @@
-/**
- * This file is part of Eclipse Steady.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
- */
-package org.eclipse.steady.kb.command;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import java.util.HashMap;
-import org.apache.commons.cli.Options;
-import org.eclipse.steady.kb.exception.CommandLineParserException;
-import org.junit.Test;
-
-public class CommandParserTest {
-
-  private static final String UPLOAD_CONSTRUCT_OPTION = "u";
-  private static final String DIRECTORY_OPTION = "d";
-  private static final String OVERWRITE_OPTION = "o";
-  private static final String VERBOSE_OPTION = "v";
-
-  private static final String UPLOAD_LONG_OPTION = "upload";
-  private static final String VERBOSE_LONG_OPTION = "verbose";
-  private static final String OVERWRITE_LONG_OPTION = "overwrite";
-  private static final String DIRECTORY_LONG_OPTION = "directory";
-
-  @Test
-  public void testParse() throws CommandLineParserException {
-    Options options = new Options();
-    options.addRequiredOption(
-        DIRECTORY_OPTION,
-        DIRECTORY_LONG_OPTION,
-        true,
-        "directory containing mutiple commit folders with meta files");
-    options.addOption(
-        OVERWRITE_OPTION,
-        OVERWRITE_LONG_OPTION,
-        false,
-        "overwrite the bug if it already exists in the backend");
-    options.addOption(VERBOSE_OPTION, VERBOSE_LONG_OPTION, false, "Verbose mode");
-    options.addOption(
-        UPLOAD_CONSTRUCT_OPTION, UPLOAD_LONG_OPTION, false, "Upload construct changes");
-
-    String _args = "-d test -u -v";
-    HashMap<String, Object> parsedCommands = CommandParser.parse(_args.split(" "), options);
-    assertEquals("test", parsedCommands.get(DIRECTORY_OPTION));
-    assertTrue((boolean) parsedCommands.get(VERBOSE_OPTION));
-    assertTrue((boolean) parsedCommands.get(UPLOAD_CONSTRUCT_OPTION));
-    assertFalse((boolean) parsedCommands.get(OVERWRITE_OPTION));
-  }
-
-  @Test(expected = CommandLineParserException.class)
-  public void testRequiredOptions() throws CommandLineParserException {
-    Options options = new Options();
-    options.addRequiredOption(
-        DIRECTORY_OPTION,
-        DIRECTORY_LONG_OPTION,
-        true,
-        "directory containing mutiple commit folders with meta files");
-    options.addOption(
-        OVERWRITE_OPTION,
-        OVERWRITE_LONG_OPTION,
-        false,
-        "overwrite the bug if it already exists in the backend");
-    options.addOption(VERBOSE_OPTION, VERBOSE_LONG_OPTION, false, "Verbose mode");
-    options.addOption(
-        UPLOAD_CONSTRUCT_OPTION, UPLOAD_LONG_OPTION, false, "Upload construct changes");
-
-    String _args = "-u -v";
-    CommandParser.parse(_args.split(" "), options);
-  }
-}
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/command/ImportTest.java b/kb-importer/src/test/java/org/eclipse/steady/kb/command/ImportTest.java
deleted file mode 100755
index 5146fbcf1..000000000
--- a/kb-importer/src/test/java/org/eclipse/steady/kb/command/ImportTest.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * This file is part of Eclipse Steady.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * SPDX-License-Identifier: Apache-2.0
- * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
- */
-package org.eclipse.steady.kb.command;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import java.util.HashMap;
-import org.apache.commons.cli.Options;
-import org.eclipse.steady.kb.exception.ValidationException;
-import org.junit.Test;
-
-public class ImportTest {
-  @Test
-  public void getOptions() {
-    Command command = new Import();
-    Options options = command.getOptions();
-    assertEquals(options.getOptions().size(), 4);
-    assertTrue(options.hasOption("d"));
-    assertTrue(options.hasOption("u"));
-    assertTrue(options.hasOption("v"));
-    assertTrue(options.hasOption("o"));
-  }
-
-  @Test
-  public void validate() throws ValidationException {
-    Command command = new Import();
-    HashMap<String, Object> args = new HashMap<String, Object>();
-    args.put("d", ImportTest.class.getClassLoader().getResource("testRootDir1").getPath());
-    command.validate(args);
-  }
-
-  @Test(expected = ValidationException.class)
-  public void validationFail() throws ValidationException {
-    Command command = new Import();
-    HashMap<String, Object> args = new HashMap<String, Object>();
-    args.put("d", "invalidDir");
-    command.validate(args);
-  }
-}
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/task/MockBackConnector.java b/kb-importer/src/test/java/org/eclipse/steady/kb/task/MockBackConnector.java
index 231d79769..1dc6fbe70 100644
--- a/kb-importer/src/test/java/org/eclipse/steady/kb/task/MockBackConnector.java
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/task/MockBackConnector.java
@@ -1,6 +1,8 @@
 package org.eclipse.steady.kb.task;
 
 import java.util.ArrayList;
+import java.util.List;
+
 import org.eclipse.steady.backend.BackendConnectionException;
 import org.eclipse.steady.backend.BackendConnector;
 import org.eclipse.steady.goals.GoalContext;
@@ -12,6 +14,8 @@
 
 public class MockBackConnector extends BackendConnector {
   private String uploadJson;
+  private List<String> uploadedLibraries = new ArrayList<String>();
+  private List<String> uploadedChangeLists = new ArrayList<String>();
 
   @Override
   public AffectedLibrary[] getBugAffectedLibraries(
@@ -62,11 +66,13 @@ public void uploadBugAffectedLibraries(
       GoalContext _g, String _bugId, String _json, AffectedVersionSource _source)
       throws BackendConnectionException {
     uploadJson = _json;
+    uploadedLibraries.add(_json);
   }
 
   @Override
   public void uploadChangeList(String _bug, String _json) throws BackendConnectionException {
     uploadJson = _json;
+    uploadedChangeLists.add(_json);
   }
 
   @Override
@@ -85,4 +91,12 @@ public boolean isBugExisting(String _bug) throws BackendConnectionException {
   public String getUploadJson() {
     return uploadJson;
   }
+
+  public List<String> getUploadedChangeLists() {
+    return uploadedChangeLists;
+  }
+
+  public List<String> getUploadedLibraries() {
+    return uploadedLibraries;
+  }
 }
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestExtractOrCloneCVE20181270.java b/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestExtractOrCloneCVE20181270.java
new file mode 100644
index 000000000..8980f31a4
--- /dev/null
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestExtractOrCloneCVE20181270.java
@@ -0,0 +1,112 @@
+package org.eclipse.steady.kb.task;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.logging.log4j.Logger;
+import org.eclipse.steady.kb.ImportCommand;
+import org.eclipse.steady.kb.Manager;
+import org.eclipse.steady.kb.model.Vulnerability;
+import org.eclipse.steady.kb.util.Metadata;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+
+/**
+ * Tests the {@link ExtractOrClone} task with CVE-2018-1270, whose fix commits
+ * only modified existing files. Depending on whether the dir parameter, the
+ * repo will be cloned (<p>testRootDir7</p>) or not
+ * (<p>statements/CVE-2018-1270</p>).
+ */
+@RunWith(Parameterized.class)
+public class TestExtractOrCloneCVE20181270 {
+
+  @Parameterized.Parameters
+  public static List directories() {
+    return Arrays.asList(new Object[][] {{"statements/CVE-2018-1270"}, {"testRootDir7"}});
+  }
+
+  private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
+  
+  Manager manager;
+  ClassLoader classLoader;
+  String dirPath;
+  File dir;
+
+  @Before
+  public void initialize() {
+    this.manager = new Manager();
+    classLoader = getClass().getClassLoader();
+  }
+
+  public TestExtractOrCloneCVE20181270(String dirName) {
+    classLoader = getClass().getClassLoader();
+    this.dirPath = classLoader.getResource(dirName).getPath();
+    this.dir = new File(dirPath);
+  }
+
+  @Test
+  public void testClone() throws IOException {
+
+    String statementPath = dirPath + File.separator + "statement.yaml";
+
+    Vulnerability vuln = Metadata.getFromYaml(statementPath);
+
+    HashMap<String, Object> args = new HashMap<String, Object>();
+    //args.put("v", false);
+    args.put(ImportCommand.OVERWRITE_OPTION, false);
+    args.put(ImportCommand.DIRECTORY_OPTION, "");
+
+    ExtractOrClone extractOrClone = new ExtractOrClone(manager, vuln, this.dir, false);
+    extractOrClone.execute();
+
+    File commitDir1before =
+        new File(
+            dirPath
+                + File.separator
+                + "1db7e02de3eb0c011ee6681f5a12eb9d166fea8"
+                + File.separator
+                + "before");
+    File commitDir1after =
+        new File(
+            dirPath
+                + File.separator
+                + "1db7e02de3eb0c011ee6681f5a12eb9d166fea8"
+                + File.separator
+                + "after");
+    File someJavaFile =
+        new File(
+            dirPath
+                + File.separator
+                + "1db7e02de3eb0c011ee6681f5a12eb9d166fea8/after/spring-expression/src/test/java/org/springframework/expression/spel/SpelCompilationCoverageTests.java");
+    File commitDir2 =
+        new File(dirPath + File.separator + "d3acf45ea4db51fa5c4cbd0bc0e7b6d9ef805e6");
+    File commitDir3 =
+        new File(dirPath + File.separator + "e0de9126ed8cf25cf141d3e66420da94e350708");
+
+    org.junit.Assert.assertEquals(commitDir1before.exists(), true);
+    org.junit.Assert.assertEquals(commitDir1after.exists(), true);
+
+    org.junit.Assert.assertEquals(commitDir1before.list().length == 1, true);
+    org.junit.Assert.assertEquals(commitDir1after.list().length == 1, true);
+
+    org.junit.Assert.assertEquals(someJavaFile.exists(), true);
+    org.junit.Assert.assertEquals(commitDir2.exists(), true);
+    org.junit.Assert.assertEquals(commitDir3.exists(), true);
+  }
+
+  @After
+  public void cleanup() {
+    try {
+      FileUtils.deleteDirectory(this.dir);
+    } catch (IOException e) {
+      log.error(e.getMessage());
+    }
+  }
+}
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestExtractOrCloneCVE20197619.java b/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestExtractOrCloneCVE20197619.java
new file mode 100644
index 000000000..da5f33523
--- /dev/null
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestExtractOrCloneCVE20197619.java
@@ -0,0 +1,119 @@
+package org.eclipse.steady.kb.task;
+
+import static org.junit.Assert.*;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.logging.log4j.Logger;
+import org.eclipse.steady.kb.ImportCommand;
+import org.eclipse.steady.kb.Manager;
+import org.eclipse.steady.kb.model.Vulnerability;
+import org.eclipse.steady.kb.util.Metadata;
+import org.eclipse.steady.shared.enums.DigestAlgorithm;
+import org.eclipse.steady.shared.util.FileUtil;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+
+/**
+ * Tests the {@link ExtractOrClone} task with CVE-2019-7619, whose fix commits
+ * added new files. Depending on whether the dir parameter, the repo will be
+ * cloned (<p>statements/CVE-2019-7619</p>) or not (n/a).
+ */
+@RunWith(Parameterized.class)
+public class TestExtractOrCloneCVE20197619 {
+
+  @Parameterized.Parameters
+  public static List directories() {
+    return Arrays.asList(new Object[][] { {"statements/CVE-2019-7619"}});
+  }
+
+  private static final Logger log = org.apache.logging.log4j.LogManager.getLogger();
+  
+  Manager manager;
+  ClassLoader classLoader;
+  String dirPath;
+  File dir;
+
+  @Before
+  public void initialize() {
+    this.manager = new Manager();
+    classLoader = getClass().getClassLoader();
+  }
+
+  public TestExtractOrCloneCVE20197619(String dirName) {
+    classLoader = getClass().getClassLoader();
+    this.dirPath = classLoader.getResource(dirName).getPath();
+    this.dir = new File(dirPath);
+  }
+
+  @Test
+  public void testClone() throws IOException {
+
+    String statementPath = dirPath + File.separator + "statement.yaml";
+
+    Vulnerability vuln = Metadata.getFromYaml(statementPath);
+
+    HashMap<String, Object> args = new HashMap<String, Object>();
+    //args.put("v", false);
+    args.put(ImportCommand.OVERWRITE_OPTION, false);
+    args.put(ImportCommand.DIRECTORY_OPTION, "");
+
+    ExtractOrClone extractOrClone = new ExtractOrClone(manager, vuln, this.dir, false);
+    extractOrClone.execute();
+
+    File commitDir1before =
+        new File(
+            dirPath
+                + File.separator
+                + "9964d89dd5d67cf72a85eb48d76347f09bd875f"
+                + File.separator
+                + "before");
+    File commitDir1after =
+        new File(
+            dirPath
+                + File.separator
+                + "9964d89dd5d67cf72a85eb48d76347f09bd875f"
+                + File.separator
+                + "after");
+
+    assertTrue(commitDir1before.exists());
+    assertTrue(commitDir1after.exists());
+    
+    // Two subdirectories each
+    assertTrue(commitDir1before.list().length == 2);
+    assertTrue(commitDir1after.list().length == 2);
+    
+    // Ensure files exist in after/ with given SHA1 digests
+    Path only_after_file = commitDir1after.toPath().resolve(Paths.get("client/rest-high-level/roles.yml"));
+    assertTrue(only_after_file.toFile().exists());
+    assertEquals(FileUtil.getDigest(only_after_file.toFile(), DigestAlgorithm.SHA1), "b32c4d48d2197602d0c03b35a29b32d0ec94b1cc".toUpperCase());
+    only_after_file = commitDir1after.toPath().resolve(Paths.get("x-pack/plugin/src/test/resources/rest-api-spec/test/api_key/11_invalidation.yml"));
+    assertTrue(only_after_file.toFile().exists());
+    assertEquals(FileUtil.getDigest(only_after_file.toFile(), DigestAlgorithm.SHA1), "9ea2ba219fd84f6c5cf974ce37b6663cb7961444".toUpperCase());
+
+    // Ensure files do not exist in before/
+    Path not_before_file = commitDir1before.toPath().resolve(Paths.get("client/rest-high-level/roles.yml"));
+    assertFalse(not_before_file.toFile().exists());
+    not_before_file = commitDir1before.toPath().resolve(Paths.get("x-pack/plugin/src/test/resources/rest-api-spec/test/api_key/11_invalidation.yml"));
+    assertFalse(not_before_file.toFile().exists());
+  }
+
+  @After
+  public void cleanup() {
+    try {
+      FileUtils.deleteDirectory(this.dir);
+    } catch (IOException e) {
+      log.error(e.getMessage());
+    }
+  }
+}
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportAffectedLibraries.java b/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportAffectedLibraries.java
index a14d38c1d..1dbb808cb 100644
--- a/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportAffectedLibraries.java
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportAffectedLibraries.java
@@ -4,15 +4,18 @@
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
+
 import org.eclipse.steady.backend.BackendConnectionException;
 import org.eclipse.steady.core.util.CoreConfiguration;
-import org.eclipse.steady.kb.command.ImportTest;
+import org.eclipse.steady.kb.ImportCommand;
+import org.eclipse.steady.kb.TestImportCommand;
 import org.eclipse.steady.kb.model.Artifact;
 import org.eclipse.steady.kb.model.Vulnerability;
 import org.eclipse.steady.kb.util.Metadata;
 import org.eclipse.steady.shared.json.model.AffectedLibrary;
 import org.eclipse.steady.shared.util.VulasConfiguration;
 import org.junit.Test;
+
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.github.packageurl.MalformedPackageURLException;
 import com.google.gson.JsonSyntaxException;
@@ -28,12 +31,12 @@ public void testImportAffectedLibs()
             (CoreConfiguration.ConnectType.READ_WRITE.toString()));
     ImportAffectedLibraries importAffectedLibs = new ImportAffectedLibraries();
     Vulnerability vuln =
-        Metadata.getVulnerabilityMetadata(
-            ImportTest.class.getClassLoader().getResource("CVE-2011-4343").getPath());
+        Metadata.getFromMetadata(
+            TestImportCommand.class.getClassLoader().getResource("CVE-2011-4343").getPath());
     MockBackConnector mockBackendConnector = new MockBackConnector();
     HashMap<String, Object> args = new HashMap<String, Object>();
-    args.put("v", false);
-    args.put("o", false);
+    args.put(ImportCommand.VERBOSE_OPTION, false);
+    args.put(ImportCommand.OVERWRITE_OPTION, false);
     importAffectedLibs.execute(vuln, args, mockBackendConnector);
     ObjectMapper mapper = new ObjectMapper();
     List<AffectedLibrary> listAffectedLibUpserted =
@@ -53,12 +56,12 @@ public void testImportAffectedLibsOverwrite()
             (CoreConfiguration.ConnectType.READ_WRITE.toString()));
     ImportAffectedLibraries importAffectedLibs = new ImportAffectedLibraries();
     Vulnerability vuln =
-        Metadata.getVulnerabilityMetadata(
-            ImportTest.class.getClassLoader().getResource("CVE-2011-4343").getPath());
+        Metadata.getFromMetadata(
+            TestImportCommand.class.getClassLoader().getResource("CVE-2011-4343").getPath());
     MockBackConnector mockBackendConnector = new MockBackConnector();
     HashMap<String, Object> args = new HashMap<String, Object>();
-    args.put("o", true);
-    args.put("v", false);
+    args.put(ImportCommand.OVERWRITE_OPTION, true);
+    args.put(ImportCommand.VERBOSE_OPTION, false);
     importAffectedLibs.execute(vuln, args, mockBackendConnector);
     ObjectMapper mapper = new ObjectMapper();
     List<AffectedLibrary> listAffectedLibUpserted =
@@ -74,11 +77,11 @@ public void testImportAffectedLibsNullData()
           IOException {
     ImportAffectedLibraries importAffectedLibs = new ImportAffectedLibraries();
     Vulnerability vuln =
-        Metadata.getVulnerabilityMetadata(
-            ImportTest.class.getClassLoader().getResource("CVE-2011-4343").getPath());
+        Metadata.getFromMetadata(
+            TestImportCommand.class.getClassLoader().getResource("CVE-2011-4343").getPath());
     vuln.setArtifacts(new ArrayList<Artifact>());
     HashMap<String, Object> args = new HashMap<String, Object>();
-    args.put("o", false);
+    args.put(ImportCommand.OVERWRITE_OPTION, false);
     importAffectedLibs.execute(vuln, args, null);
   }
 }
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportVulnerability.java b/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportVulnerability.java
index 0bae728f7..c7a271e34 100644
--- a/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportVulnerability.java
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportVulnerability.java
@@ -2,13 +2,15 @@
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
+
 import java.io.File;
 import java.io.IOException;
 import java.util.HashMap;
+
 import org.apache.commons.io.FileUtils;
 import org.eclipse.steady.backend.BackendConnectionException;
 import org.eclipse.steady.core.util.CoreConfiguration;
+import org.eclipse.steady.kb.ImportCommand;
 import org.eclipse.steady.kb.ZipUtil;
 import org.eclipse.steady.kb.model.Vulnerability;
 import org.eclipse.steady.kb.util.ConstructSet;
@@ -18,6 +20,7 @@
 import org.junit.AfterClass;
 import org.junit.Before;
 import org.junit.Test;
+
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.gson.JsonSyntaxException;
 
@@ -43,12 +46,12 @@ public void testImportVuln() throws JsonSyntaxException, IOException, BackendCon
         .setProperty(
             CoreConfiguration.BACKEND_CONNECT,
             (CoreConfiguration.ConnectType.READ_WRITE.toString()));
-    Vulnerability vuln = Metadata.getVulnerabilityMetadata(destPathToUnzip + REPO);
+    Vulnerability vuln = Metadata.getFromMetadata(destPathToUnzip + REPO);
     MockBackConnector mockBackendConnector = new MockBackConnector();
     HashMap<String, Object> args = new HashMap<String, Object>();
-    args.put("d", destPathToUnzip + REPO);
-    args.put("o", false);
-    args.put("v", false);
+    args.put(ImportCommand.DIRECTORY_OPTION, destPathToUnzip + REPO);
+    args.put(ImportCommand.OVERWRITE_OPTION, false);
+    args.put(ImportCommand.VERBOSE_OPTION, false);
     ImportVulnerability importVuln = new ImportVulnerability();
     importVuln.execute(vuln, args, mockBackendConnector);
     ObjectMapper mapper = new ObjectMapper();
@@ -58,20 +61,6 @@ public void testImportVuln() throws JsonSyntaxException, IOException, BackendCon
     assertNotNull(bug.getDescription());
   }
 
-  @Test
-  public void testImportVulnSkipExistingBug()
-      throws JsonSyntaxException, IOException, BackendConnectionException {
-    Vulnerability vuln = new Vulnerability();
-    vuln.setVulnId("CVE-TEST01");
-    MockBackConnector mockBackendConnector = new MockBackConnector();
-    HashMap<String, Object> args = new HashMap<String, Object>();
-    args.put("o", false);
-    args.put("v", false);
-    ImportVulnerability importVuln = new ImportVulnerability();
-    importVuln.execute(vuln, args, mockBackendConnector);
-    assertNull(mockBackendConnector.getUploadJson());
-  }
-
   @AfterClass
   public static void cleanup() {
     try {
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportVulnerability_CVE_2017_2617.java b/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportVulnerability_CVE_2017_2617.java
index 6c8ba8ba2..d21bb6a2b 100644
--- a/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportVulnerability_CVE_2017_2617.java
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/task/TestImportVulnerability_CVE_2017_2617.java
@@ -2,12 +2,15 @@
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
+
 import java.io.File;
 import java.io.IOException;
 import java.util.HashMap;
+
 import org.apache.commons.io.FileUtils;
 import org.eclipse.steady.backend.BackendConnectionException;
 import org.eclipse.steady.core.util.CoreConfiguration;
+import org.eclipse.steady.kb.ImportCommand;
 import org.eclipse.steady.kb.ZipUtil;
 import org.eclipse.steady.kb.model.Vulnerability;
 import org.eclipse.steady.kb.util.ConstructSet;
@@ -17,6 +20,7 @@
 import org.junit.AfterClass;
 import org.junit.Before;
 import org.junit.Test;
+
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.gson.JsonSyntaxException;
 
@@ -42,12 +46,12 @@ public void testImportVuln() throws JsonSyntaxException, IOException, BackendCon
         .setProperty(
             CoreConfiguration.BACKEND_CONNECT,
             (CoreConfiguration.ConnectType.READ_WRITE.toString()));
-    Vulnerability vuln = Metadata.getVulnerabilityMetadata(destPathToUnzip + REPO);
+    Vulnerability vuln = Metadata.getFromMetadata(destPathToUnzip + REPO);
     MockBackConnector mockBackendConnector = new MockBackConnector();
     HashMap<String, Object> args = new HashMap<String, Object>();
-    args.put("d", destPathToUnzip + File.separator + REPO);
-    args.put("o", false);
-    args.put("v", false);
+    args.put(ImportCommand.DIRECTORY_OPTION, destPathToUnzip + File.separator + REPO);
+    args.put(ImportCommand.OVERWRITE_OPTION, false);
+    args.put(ImportCommand.VERBOSE_OPTION, false);
     ImportVulnerability importVuln = new ImportVulnerability();
     importVuln.execute(vuln, args, mockBackendConnector);
     ObjectMapper mapper = new ObjectMapper();
diff --git a/kb-importer/src/test/java/org/eclipse/steady/kb/util/MetadataTest.java b/kb-importer/src/test/java/org/eclipse/steady/kb/util/MetadataTest.java
old mode 100755
new mode 100644
index b5a02c0a6..a887d46e7
--- a/kb-importer/src/test/java/org/eclipse/steady/kb/util/MetadataTest.java
+++ b/kb-importer/src/test/java/org/eclipse/steady/kb/util/MetadataTest.java
@@ -20,11 +20,13 @@
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNull;
+
 import java.io.IOException;
 
 import org.eclipse.steady.kb.model.Commit;
 import org.eclipse.steady.kb.model.Vulnerability;
 import org.junit.Test;
+
 import com.google.gson.JsonSyntaxException;
 
 public class MetadataTest {
@@ -32,7 +34,7 @@ public class MetadataTest {
   public void testGetVulnMetadata() throws JsonSyntaxException, IOException {
     ClassLoader classLoader = getClass().getClassLoader();
     String path = classLoader.getResource("testRootDir1").getPath();
-    Vulnerability vuln = Metadata.getVulnerabilityMetadata(path);
+    Vulnerability vuln = Metadata.getFromMetadata(path);
     assertEquals(3, vuln.getArtifacts().size());
     assertEquals(3, vuln.getNotes().size());
     assertEquals("COLLECTIONS-580", vuln.getVulnId());
@@ -40,29 +42,27 @@ public void testGetVulnMetadata() throws JsonSyntaxException, IOException {
 
   @Test(expected = IllegalArgumentException.class)
   public void testInvalidVulnRootDir() throws JsonSyntaxException, IOException {
-    Metadata.getVulnerabilityMetadata("rootDir1test");
+    Metadata.getFromMetadata("rootDir1test");
   }
 
   @Test(expected = IllegalArgumentException.class)
   public void testNoVulnIdArg() throws Exception, IOException {
     ClassLoader classLoader = getClass().getClassLoader();
     String path = classLoader.getResource("testRootDir2").getPath();
-    Metadata.getVulnerabilityMetadata(path);
+    Metadata.getFromMetadata(path);
   }
 
   @Test
   public void testMissingNonMandatoryParams() throws JsonSyntaxException, IOException {
-    ClassLoader classLoader = getClass().getClassLoader();
-    String path = classLoader.getResource("testRootDir3").getPath();
-    Vulnerability vuln = Metadata.getVulnerabilityMetadata(path);
+    String path = "./src/test/resources/testRootDir3";
+    Vulnerability vuln = Metadata.getFromMetadata(path);
     assertNull(vuln.getNotes());
     assertEquals("COLLECTIONS-580", vuln.getVulnId());
   }
 
   @Test
   public void testGetCommitMetadata() throws JsonSyntaxException, IOException {
-    ClassLoader classLoader = getClass().getClassLoader();
-    String path = classLoader.getResource("commitDir1").getPath();
+    String path = "./src/test/resources/commitDir1";
     Commit commit = Metadata.getCommitMetadata(path);
     assertEquals("master", commit.getBranch());
     assertEquals("b2b8f4adc557e4ef1ee2fe5e0ab46866c06ec55b", commit.getCommitId());
@@ -75,15 +75,15 @@ public void testGetCommitMetadata() throws JsonSyntaxException, IOException {
   public void testMetadataArtifacts() throws JsonSyntaxException, IOException {
     ClassLoader classLoader = getClass().getClassLoader();
     String path = classLoader.getResource("testRootDir4").getPath();
-    Vulnerability vuln = Metadata.getVulnerabilityMetadata(path);
+    Vulnerability vuln = Metadata.getFromMetadata(path);
     assertEquals(3, vuln.getArtifacts().size());
   }
 
   @Test
-  public void testMetadataArtifactsPUrl() throws JsonSyntaxException, IOException {
+  public void testMetadataArtifactsPurl() throws JsonSyntaxException, IOException {
     ClassLoader classLoader = getClass().getClassLoader();
     String path = classLoader.getResource("testRootDir5").getPath();
-    Vulnerability vuln = Metadata.getVulnerabilityMetadata(path);
+    Vulnerability vuln = Metadata.getFromMetadata(path);
     assertEquals(1, vuln.getArtifacts().size());
     assertEquals(false, vuln.getArtifacts().get(0).getAffected());
     assertEquals(
@@ -94,6 +94,14 @@ public void testMetadataArtifactsPUrl() throws JsonSyntaxException, IOException
 
   @Test(expected = IllegalArgumentException.class)
   public void testInvalidCommitMetadataDir() throws JsonSyntaxException, IOException {
-    Metadata.getVulnerabilityMetadata("commitDir2");
+    Metadata.getFromMetadata("commitDir2");
+  }
+
+  @Test
+  public void testGetFromYaml() throws IOException {
+    Vulnerability vuln = Metadata.getFromYaml("./src/test/resources/testRootDir1/statement.yaml");
+    assertEquals(3, vuln.getArtifacts().size());
+    assertEquals(3, vuln.getNotes().size());
+    assertEquals("COLLECTIONS-580", vuln.getVulnId());
   }
 }
diff --git a/kb-importer/src/test/resources/commitDir1/metadata.json b/kb-importer/src/test/resources/commitDir1/metadata.json
old mode 100755
new mode 100644
diff --git a/kb-importer/src/test/resources/statements/CVE-2018-1270/changed-source-code.tar.gz b/kb-importer/src/test/resources/statements/CVE-2018-1270/changed-source-code.tar.gz
new file mode 100644
index 000000000..5582d1782
Binary files /dev/null and b/kb-importer/src/test/resources/statements/CVE-2018-1270/changed-source-code.tar.gz differ
diff --git a/kb-importer/src/test/resources/statements/CVE-2018-1270/statement.yaml b/kb-importer/src/test/resources/statements/CVE-2018-1270/statement.yaml
new file mode 100644
index 000000000..4c4e71e13
--- /dev/null
+++ b/kb-importer/src/test/resources/statements/CVE-2018-1270/statement.yaml
@@ -0,0 +1,630 @@
+vulnerability_id: CVE-2018-1270
+notes:
+- text: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
+fixes:
+- id: 5.x
+  commits:
+  - id: 1db7e02de3eb0c011ee6681f5a12eb9d166fea8
+    repository: https://github.com/spring-projects/spring-framework
+  - id: e0de9126ed8cf25cf141d3e66420da94e350708
+    repository: https://github.com/spring-projects/spring-framework
+- id: 4.x
+  commits:
+  - id: d3acf45ea4db51fa5c4cbd0bc0e7b6d9ef805e6
+    repository: https://github.com/spring-projects/spring-framework
+artifacts:
+- id: pkg:maven/org.springframework/spring-messaging@4.3.17.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.5.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.11.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.2.18.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.23.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.1.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.10.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.16.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.2.0.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.11.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.8.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.15.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@3.2.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.1.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.4.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.20.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.13.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.14.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.10.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.2.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.2.5.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.0.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.0.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.0.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.2.2.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.3.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.1.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.1.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.16.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.26.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.19.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.5.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.15.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.2.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.19.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.2.12.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.2.2.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.1.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.1.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.0.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.13.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.18.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.1.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.1.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.11.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.2.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.1.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression@3.2.18.RELEASE_1
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.16.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.10.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.2.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.11.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.2.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.2.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.0.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.13.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.activemq/activemq-all@5.13.2
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.4.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.5.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.10.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.1.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.16.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.12.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.0.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.1.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.2.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.22.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.5.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.21.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.3.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.1.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.12.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.13.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.0.9.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.17.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression@3.2.16.RELEASE_1
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.2.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.11.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.2.4.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.14.5
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.3.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.0.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.2.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.15.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@3.1.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.1.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.0.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.4.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.18.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.24.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.1.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.12.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.0.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.2
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.8.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.0.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.0
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: true
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.6
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.2.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.15.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.10
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.12.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.9
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.11
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.8
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.12
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.14.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.2.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.2.1.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.22.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression@3.2.14.RELEASE_1
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression@4.3.24.RELEASE_1
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.13
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.10.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.14.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.1.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.2.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.15.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.0.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.11.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.9.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.2.16.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.0.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@3.2.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.14.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@3.0.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.5.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.21.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.2.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.0.10.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.23.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.1.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.17.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.17.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.16.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.2.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/p2.eclipse-plugin/com.wily.apm.data.model@10.5.2.91
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.1.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression@4.3.18.RELEASE_1
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.14.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.0.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.2.3.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.26.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.24.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.12.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.9.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.0.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.12.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.17.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.9.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.1.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@3.2.8.RELEASE
+  reason: Reviewed manually
+  affected: true
diff --git a/kb-importer/src/test/resources/statements/CVE-2019-7619/statement.yaml b/kb-importer/src/test/resources/statements/CVE-2019-7619/statement.yaml
new file mode 100644
index 000000000..c178d59f8
--- /dev/null
+++ b/kb-importer/src/test/resources/statements/CVE-2019-7619/statement.yaml
@@ -0,0 +1,8 @@
+vulnerability_id: CVE-2019-7619
+notes:
+- text: Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.
+fixes:
+- id: DEFAULT_BRANCH
+  commits:
+  - id: 9964d89dd5d67cf72a85eb48d76347f09bd875f
+    repository: https://github.com/elastic/elasticsearch
diff --git a/kb-importer/src/test/resources/testAffectedLibs/metadata.json b/kb-importer/src/test/resources/testAffectedLibs/metadata.json
old mode 100755
new mode 100644
diff --git a/kb-importer/src/test/resources/testRootDir1/metadata.json b/kb-importer/src/test/resources/testRootDir1/metadata.json
old mode 100755
new mode 100644
diff --git a/kb-importer/src/test/resources/testRootDir1/statement.yaml b/kb-importer/src/test/resources/testRootDir1/statement.yaml
new file mode 100644
index 000000000..7ffa4cddd
--- /dev/null
+++ b/kb-importer/src/test/resources/testRootDir1/statement.yaml
@@ -0,0 +1,26 @@
+api_version: v1
+vulnerability_id: COLLECTIONS-580
+aliases:
+- TEST-1234
+- SOME-OTHER-ID-1234
+artifacts:
+- id: pkg:maven/org.apache.commons/commons-collections4@4.0
+  affected: true
+  reason: Test    
+- id: pkg:maven/org.apache.commons/commons-collections4@4.0.1-SNAPSHOT
+  affected: true
+  reason: Test
+- id: pkg:maven/org.apache.commons/commons-collections4@4.1
+  affected: false
+  reason: Test
+notes: 
+- links:
+  - https://issues.apache.org/jira/browse/COLLECTIONS-580
+  text: Arbitrary remote code execution with InvokerTransformer
+- links: 
+  - https://issues.apache.org/jira/browse/COLLECTIONS-580
+  - https://github.com/apache/commons-collections/commit/b2b8f4adc557e4ef1ee2fe5e0ab46866c06ec55b
+  text: With InvokerTransformer serializable collections can be build that execute arbitrary Java code.
+- links:
+  - https://issues.apache.org/jira/browse/COLLECTIONS-580
+  text: With InvokerTransformer serializable collections can be build that execute arbitrary Java code.
\ No newline at end of file
diff --git a/kb-importer/src/test/resources/testRootDir2/metadata.json b/kb-importer/src/test/resources/testRootDir2/metadata.json
old mode 100755
new mode 100644
diff --git a/kb-importer/src/test/resources/testRootDir3/metadata.json b/kb-importer/src/test/resources/testRootDir3/metadata.json
old mode 100755
new mode 100644
diff --git a/kb-importer/src/test/resources/testRootDir4/metadata.json b/kb-importer/src/test/resources/testRootDir4/metadata.json
old mode 100755
new mode 100644
diff --git a/kb-importer/src/test/resources/testRootDir5/metadata.json b/kb-importer/src/test/resources/testRootDir5/metadata.json
old mode 100755
new mode 100644
diff --git a/kb-importer/src/test/resources/testRootDir7/statement.yaml b/kb-importer/src/test/resources/testRootDir7/statement.yaml
new file mode 100644
index 000000000..4c4e71e13
--- /dev/null
+++ b/kb-importer/src/test/resources/testRootDir7/statement.yaml
@@ -0,0 +1,630 @@
+vulnerability_id: CVE-2018-1270
+notes:
+- text: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
+fixes:
+- id: 5.x
+  commits:
+  - id: 1db7e02de3eb0c011ee6681f5a12eb9d166fea8
+    repository: https://github.com/spring-projects/spring-framework
+  - id: e0de9126ed8cf25cf141d3e66420da94e350708
+    repository: https://github.com/spring-projects/spring-framework
+- id: 4.x
+  commits:
+  - id: d3acf45ea4db51fa5c4cbd0bc0e7b6d9ef805e6
+    repository: https://github.com/spring-projects/spring-framework
+artifacts:
+- id: pkg:maven/org.springframework/spring-messaging@4.3.17.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.5.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.11.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.2.18.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.23.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.1.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.10.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.16.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.2.0.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.11.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.8.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.15.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@3.2.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.1.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.4.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.20.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.13.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.14.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.10.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.2.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.2.5.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.0.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.0.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.0.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.2.2.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.3.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.1.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.1.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.16.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.26.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.19.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.5.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.15.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.2.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.19.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.2.12.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.2.2.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.13.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.1.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.1.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.0.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.13.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.18.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.1.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.1.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.11.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.2.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.25.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.1.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression@3.2.18.RELEASE_1
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.16.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.10.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.2.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.11.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.2.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.2.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.20.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.0.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.13.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.activemq/activemq-all@5.13.2
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.4.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.5.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.10.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.1.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.16.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.12.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.0.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.1.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.2.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.22.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.5.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.21.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.3.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.1.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.12.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.13.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.0.9.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.17.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression@3.2.16.RELEASE_1
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.2.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.11.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.2.4.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.14.5
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.3.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.0.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.2.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.15.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@3.1.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.1.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.0.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.4.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.2.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.18.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.24.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.1.8.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.12.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.0.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.2
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.8.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.0.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.0
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: true
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.6
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.2.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.15.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.10
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.12.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.9
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.11
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.8
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.12
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.14.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.2.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.2.1.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.22.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression@3.2.14.RELEASE_1
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression@4.3.24.RELEASE_1
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.apache.activemq/activemq-all@5.15.13
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.10.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.0.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.14.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.1.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.2.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.15.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.0.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.11.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.9.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.2.16.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.0.7.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@3.2.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.14.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@3.0.6.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.5.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.21.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.2.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.0.10.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.23.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.1.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.17.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.17.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.1.16.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.2.7.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.1.6.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/p2.eclipse-plugin/com.wily.apm.data.model@10.5.2.91
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.1.2.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.apache.servicemix.bundles/org.apache.servicemix.bundles.spring-expression@4.3.18.RELEASE_1
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.1.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@5.1.14.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.0.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.2.0.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.2.3.RELEASE
+  reason: Reviewed manually
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.3.26.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.2.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.24.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@5.0.12.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@5.1.9.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@4.0.5.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-messaging@4.3.12.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@4.3.17.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-messaging@4.3.4.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@5.0.9.RELEASE
+  reason: Assessed with Eclipse Steady (AST_EQUALITY)
+  affected: false
+- id: pkg:maven/org.springframework/spring-expression@3.1.3.RELEASE
+  reason: Reviewed manually
+  affected: true
+- id: pkg:maven/org.springframework/spring-expression@3.2.8.RELEASE
+  reason: Reviewed manually
+  affected: true
diff --git a/lang-java/src/main/java/org/eclipse/steady/java/sign/ASTSignature.java b/lang-java/src/main/java/org/eclipse/steady/java/sign/ASTSignature.java
index 3fd33d664..c2e977e14 100644
--- a/lang-java/src/main/java/org/eclipse/steady/java/sign/ASTSignature.java
+++ b/lang-java/src/main/java/org/eclipse/steady/java/sign/ASTSignature.java
@@ -58,7 +58,7 @@ public ASTSignature(EntityType label, String value) {
   @SuppressFBWarnings(
       value = "MS_PKGPROTECT",
       justification = "Subclasses can be in different packages")
-  protected static JavaMethodBodyConverter
+  protected JavaMethodBodyConverter
       sMethodBodyConverter; // Visitor for generation of the AST of construct bodies
 
   /** Constant <code>sInjector</code> */
diff --git a/lang/src/main/java/org/eclipse/steady/backend/BackendConnector.java b/lang/src/main/java/org/eclipse/steady/backend/BackendConnector.java
index be798a3e2..1c85c9afa 100755
--- a/lang/src/main/java/org/eclipse/steady/backend/BackendConnector.java
+++ b/lang/src/main/java/org/eclipse/steady/backend/BackendConnector.java
@@ -1009,7 +1009,15 @@ public void uploadPaths(GoalContext _ctx, Application _app, String _json)
   public boolean isBugExisting(String _bug) throws BackendConnectionException {
     final HttpResponse response =
         new BasicHttpRequest(HttpMethod.OPTIONS, PathBuilder.bug(_bug), null).send();
-    return response.isOk();
+    if (response.isOk()) {
+      return response.isOk();
+    } else if (response.isNotFound()) {
+      return false;
+    } else {
+      throw new BackendConnectionException(
+          "Got response code " + response.getStatus() + " when communicating with the backend",
+          null);
+    }
   }
 
   /**
@@ -1041,6 +1049,21 @@ public void uploadChangeList(String _bug, String _json) throws BackendConnection
     req_list.send();
   }
 
+  /**
+   * <p>deleteBug.</p>
+   *
+   * @param _bugId a {@link java.lang.String} object.
+   * @throws org.eclipse.steady.backend.BackendConnectionException if any.
+   */
+  public void deleteBug(String _bugId) throws BackendConnectionException {
+
+    final BasicHttpRequest del_req =
+        new BasicHttpRequest(HttpMethod.DELETE, PathBuilder.bug(_bugId));
+    // payload cannot be empty otherwise request doesn t work
+    del_req.setPayload("[]", "application/json", true);
+    del_req.send();
+  }
+
   /**
    * <p>uploadCheckVersionResults.</p>
    *
@@ -1089,7 +1112,12 @@ public AffectedLibrary[] getBugAffectedLibraries(
     BasicHttpRequest request =
         new BasicHttpRequest(HttpMethod.GET, PathBuilder.bugAffectedLibs(_bugId), params);
     if (_g != null) request.setGoalContext(_g);
-    final String json = request.send().getBody();
+    final HttpResponse response = request.send();
+    if (!response.isOk()) {
+      throw new BackendConnectionException(
+          "Got respose " + response.getStatus() + " when communicating with the backend", null);
+    }
+    final String json = response.getBody();
     return (AffectedLibrary[]) JacksonUtil.asObject(json, AffectedLibrary[].class);
   }
 
@@ -1437,11 +1465,15 @@ public Artifact[] getAllArtifactsGroupArtifact(String _g, String _a)
     String json = null;
     Artifact[] result = null;
 
-    json =
+    final HttpResponse response =
         new BasicHttpRequest(
                 Service.CIA, HttpMethod.GET, PathBuilder.artifactsGroupVersion(_g, _a), null)
-            .send()
-            .getBody();
+            .send();
+    if (!response.isOk()) {
+      throw new BackendConnectionException(
+          "Got respose " + response.getStatus() + " when communicating with the backend", null);
+    }
+    json = response.getBody();
     BackendConnector.log.info("artifacts for  " + _g + ":" + _a + " received from backend");
     if (json != null) result = (Artifact[]) JacksonUtil.asObject(json, Artifact[].class);
 
@@ -1610,7 +1642,13 @@ public AffectedLibrary[] getBugAffectedLibraries(
     BasicHttpRequest request =
         new BasicHttpRequest(
             HttpMethod.GET, PathBuilder.affectedLibs(_bugId, _group, _artifact, _version), params);
-    String json = request.send().getBody();
+
+    final HttpResponse response = request.send();
+    if (!response.isOk()) {
+      throw new BackendConnectionException(
+          "Got respose " + response.getStatus() + " when communicating with the backend", null);
+    }
+    String json = response.getBody();
     if (json == null) {
       json = "[]";
     }
diff --git a/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/MvnPluginInstr.java b/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/MvnPluginInstr.java
index 31453541d..4e56c0ea9 100644
--- a/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/MvnPluginInstr.java
+++ b/plugin-maven/src/main/java/org/eclipse/steady/java/mvn/MvnPluginInstr.java
@@ -62,8 +62,8 @@ protected void executeGoal() throws Exception {
     final Path lib_dir = this.vulasConfiguration.getDir(CoreConfiguration.INSTR_LIB_DIR);
     final Path incl_dir = this.vulasConfiguration.getDir(CoreConfiguration.INSTR_INCLUDE_DIR);
 
-    final Path incl_agent = FileUtil.copyFile(this.getAgentJarFile().toPath(), incl_dir);
-    final Path lib_agent = FileUtil.copyFile(this.getAgentJarFile().toPath(), lib_dir);
+    final Path incl_agent = FileUtil.copy(this.getAgentJarFile().toPath(), incl_dir, null);
+    final Path lib_agent = FileUtil.copy(this.getAgentJarFile().toPath(), lib_dir, null);
 
     getLog()
         .info(
diff --git a/pom.xml b/pom.xml
index b2d98f331..287bc861d 100755
--- a/pom.xml
+++ b/pom.xml
@@ -189,7 +189,7 @@
 
 		<!-- Activate when deploying to the Central Repo. Also see https://central.sonatype.org/pages/apache-maven.html#nexus-staging-maven-plugin-for-deployment-and-release -->
 		<profile>
-			<id>javadoc</id>
+			<id>prepare-release</id>
 			<build>
 				<plugins>
 					<plugin>
@@ -220,6 +220,17 @@
 							</execution>
 						</executions>
 					</plugin>
+					<plugin>
+						<groupId>org.cyclonedx</groupId>
+						<artifactId>cyclonedx-maven-plugin</artifactId>
+						<version>2.6.2</version>
+						<executions>
+							<execution>
+								<phase>package</phase>
+								<goals><goal>makeAggregateBom</goal></goals>
+							</execution>
+						</executions>
+					</plugin>
 				</plugins>
 			</build>
 		</profile>
@@ -697,20 +708,6 @@
 					</execution>
 				</executions>
 			</plugin>
-			
-			<plugin>
-					<groupId>org.cyclonedx</groupId>
-					<artifactId>cyclonedx-maven-plugin</artifactId>
-					<version>2.6.2</version>
-					<executions>
-					<execution>
-						<phase>package</phase>
-						<goals><goal>makeAggregateBom</goal></goals>
-					</execution>
-					</executions>
-			</plugin>
-
-
 		</plugins>
 
 		<pluginManagement>
diff --git a/rest-backend/pom.xml b/rest-backend/pom.xml
index 151bfc586..8ac80c9b7 100644
--- a/rest-backend/pom.xml
+++ b/rest-backend/pom.xml
@@ -212,7 +212,6 @@
     		</exclusions>
 		</dependency>
 		
-
 		<!-- Used to mock REST services -->
 		<dependency>
 			<groupId>com.xebialabs.restito</groupId>
@@ -327,7 +326,7 @@
 
 		<!-- Activate when deploying to the Central Repo. Also see https://central.sonatype.org/pages/apache-maven.html#nexus-staging-maven-plugin-for-deployment-and-release -->
 		<profile>
-			<id>javadoc</id>
+			<id>prepare-release</id>
 			<build>
 				<plugins>
 					<plugin>
@@ -358,6 +357,17 @@
 							</execution>
 						</executions>
 					</plugin>
+					<plugin>
+						<groupId>org.cyclonedx</groupId>
+						<artifactId>cyclonedx-maven-plugin</artifactId>
+						<version>2.6.2</version>
+						<executions>
+							<execution>
+								<phase>package</phase>
+								<goals><goal>makeAggregateBom</goal></goals>
+							</execution>
+						</executions>
+					</plugin>
 				</plugins>
 			</build>
 		</profile>
diff --git a/rest-backend/src/test/java/org/eclipse/steady/backend/cve/NvdRestServiceMockup.java b/rest-backend/src/test/java/org/eclipse/steady/backend/cve/NvdRestServiceMockup.java
index 79fa887e7..638989dbc 100644
--- a/rest-backend/src/test/java/org/eclipse/steady/backend/cve/NvdRestServiceMockup.java
+++ b/rest-backend/src/test/java/org/eclipse/steady/backend/cve/NvdRestServiceMockup.java
@@ -40,8 +40,11 @@
 import com.xebialabs.restito.server.StubServer;
 
 /**
- * Singleton mocking the NVD REST service, which is used by different JUnit tests. Sets the system property {@link CveReader2#CVE_SERVICE_URL}.
- * To add a new vulnerability FOO, store the respective JSON as ./src/test/resources/cves/FOO-new.json and update the array {@link NvdRestServiceMockup#CVES}.
+ * Singleton mocking the NVD REST service, which is used by different JUnit
+ * tests. Sets the system property {@link CveReader2#CVE_SERVICE_URL}. To add a
+ * new vulnerability FOO, store the respective JSON as
+ * ./src/test/resources/cves/FOO-new.json and update the array
+ * {@link NvdRestServiceMockup#CVES}.
  */
 public class NvdRestServiceMockup {
 
diff --git a/rest-lib-utils/pom.xml b/rest-lib-utils/pom.xml
index cb3c51b2a..d72dfb4c3 100644
--- a/rest-lib-utils/pom.xml
+++ b/rest-lib-utils/pom.xml
@@ -311,7 +311,7 @@
 
 		<!-- Activate when deploying to the Central Repo. Also see https://central.sonatype.org/pages/apache-maven.html#nexus-staging-maven-plugin-for-deployment-and-release -->
 		<profile>
-			<id>javadoc</id>
+			<id>prepare-release</id>
 			<build>
 				<plugins>
 					<plugin>
@@ -342,6 +342,17 @@
 							</execution>
 						</executions>
 					</plugin>
+					<plugin>
+						<groupId>org.cyclonedx</groupId>
+						<artifactId>cyclonedx-maven-plugin</artifactId>
+						<version>2.6.2</version>
+						<executions>
+							<execution>
+								<phase>package</phase>
+								<goals><goal>makeAggregateBom</goal></goals>
+							</execution>
+						</executions>
+					</plugin>
 				</plugins>
 			</build>
 		</profile>
diff --git a/shared/src/main/java/org/eclipse/steady/shared/enums/GoalClient.java b/shared/src/main/java/org/eclipse/steady/shared/enums/GoalClient.java
old mode 100755
new mode 100644
diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/FileUtil.java b/shared/src/main/java/org/eclipse/steady/shared/util/FileUtil.java
index 283f75ab4..ac12d7cac 100644
--- a/shared/src/main/java/org/eclipse/steady/shared/util/FileUtil.java
+++ b/shared/src/main/java/org/eclipse/steady/shared/util/FileUtil.java
@@ -24,7 +24,6 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.io.OutputStream;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
@@ -33,9 +32,13 @@
 import java.nio.charset.IllegalCharsetNameException;
 import java.nio.charset.StandardCharsets;
 import java.nio.charset.UnsupportedCharsetException;
+import java.nio.file.CopyOption;
+import java.nio.file.FileVisitResult;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.nio.file.SimpleFileVisitor;
+import java.nio.file.attribute.BasicFileAttributes;
 import java.security.DigestInputStream;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
@@ -266,25 +269,6 @@ public static Charset getCharset() {
     }
   }
 
-  /**
-   * <p>copyFile.</p>
-   *
-   * @param _source_file a {@link java.nio.file.Path} object.
-   * @param _target_dir a {@link java.nio.file.Path} object.
-   * @return a {@link java.nio.file.Path} object.
-   * @throws java.io.IOException if any.
-   */
-  public static Path copyFile(Path _source_file, Path _target_dir) throws IOException {
-    final Path to = _target_dir.resolve(_source_file.getFileName());
-    try (final InputStream is = new FileInputStream(_source_file.toFile());
-        final OutputStream os = new FileOutputStream(to.toFile())) {
-      final byte[] byte_buffer = new byte[1024];
-      int len = 0;
-      while ((len = is.read(byte_buffer)) != -1) os.write(byte_buffer, 0, len);
-    }
-    return to;
-  }
-
   // Reading files
 
   /**
@@ -637,4 +621,59 @@ public static Boolean isZipped(File _f) throws IOException {
       return false;
     }
   }
+
+  /**
+   * Copies the given source file or directory to the given target directory. If
+   * no _target_name is provided, the source will be copied with the identical
+   * name into _target_dir. If _target_name is provided, that name will be
+   * taken.
+   *
+   * @throws java.io.IOException if any.
+   * @throws java.lang.InterruptedException if any.
+   * @throws java.lang.IllegalArgumentException if _source is neither an
+   * existing file nor directory or the target folder does not exist.
+   */
+  public static Path copy(Path _source, Path _target_dir, Path _target_name, CopyOption... options)
+    throws IOException, IllegalArgumentException {
+    
+    // Check args
+    if(!FileUtil.isAccessibleFile(_source) && !FileUtil.isAccessibleDirectory(_source)) {
+      throw new IllegalArgumentException("Source [" + _source + "] does not exist");
+    } else if(!FileUtil.isAccessibleDirectory(_target_dir)) {
+      throw new IllegalArgumentException("Target [" + _target_dir + "] does not exist or is not a directory");
+    }
+
+    Path p = _target_dir.resolve(_target_name == null ? _source.getFileName() : _target_name);
+
+    // A single file is copied
+    if(FileUtil.isAccessibleFile(_source)) {
+      log.info("Copying [" + _source + "] to [" + p + "]");
+      Files.copy(_source, p, options);
+    }
+    // A directory is copied
+    else if(FileUtil.isAccessibleDirectory(_source)) {
+      Files.walkFileTree(_source, new SimpleFileVisitor<Path>() {
+          @Override
+          public FileVisitResult preVisitDirectory(Path dir, BasicFileAttributes attrs)
+                  throws IOException {
+              Path p = _target_dir.resolve(_target_name == null ? _source.getFileName() : _target_name).resolve(_source.relativize(dir));
+              log.debug("Visiting dir [" + dir + "], creating dir [" + p + "]");
+              Files.createDirectories(p);
+              return FileVisitResult.CONTINUE;
+          }
+
+          @Override
+          public FileVisitResult visitFile(Path file, BasicFileAttributes attrs)
+                  throws IOException {
+              Path p = _target_dir.resolve(_target_name == null ? _source.getFileName() : _target_name).resolve(_source.relativize(file));
+              log.debug("Visiting file [" + file + "], copying to [" + p + "]");
+              Files.copy(file, p, options);
+              return FileVisitResult.CONTINUE;
+          }
+        }
+      );
+    }
+
+    return p;
+  }
 }
diff --git a/shared/src/main/java/org/eclipse/steady/shared/util/ProcessWrapper.java b/shared/src/main/java/org/eclipse/steady/shared/util/ProcessWrapper.java
new file mode 100755
index 000000000..36afaea1c
--- /dev/null
+++ b/shared/src/main/java/org/eclipse/steady/shared/util/ProcessWrapper.java
@@ -0,0 +1,209 @@
+/**
+ * This file is part of Eclipse Steady.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
+ */
+package org.eclipse.steady.shared.util;
+
+import java.io.IOException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.apache.logging.log4j.Logger;
+
+/**
+ * <p>ProcessWrapper class.</p>
+ */
+public class ProcessWrapper implements Runnable {
+
+  private static Logger log = org.apache.logging.log4j.LogManager.getLogger();
+
+  private static final Pattern ALLOWED = Pattern.compile("[\\.\\-\\w=/]+");
+
+  private String id = null;
+
+  private Path exe = null;
+
+  private String[] args = null;
+
+  private Path outPath = null;
+
+  private Path outFile = null;
+
+  private Path errFile;
+
+  private int exitCode = -1;
+
+  /**
+   * <p>Constructor for ProcessWrapper.</p>
+   */
+  public ProcessWrapper() {
+    this.id = StringUtil.getRandonString(10);
+  }
+
+  /**
+   * <p>Constructor for ProcessWrapper.</p>
+   *
+   * @param _id a {@link java.lang.String} object.
+   */
+  public ProcessWrapper(String _id) {
+    this.id = _id;
+  }
+
+  /**
+   * <p>Getter for the field <code>id</code>.</p>
+   *
+   * @return a {@link java.lang.String} object.
+   */
+  public String getId() {
+    return this.id;
+  }
+
+  /**
+   * <p>setCommand.</p>
+   *
+   * @param _executable a {@link java.nio.file.Path} object.
+   * @param _args a {@link java.lang.String} object.
+   * @return a {@link org.eclipse.steady.python.ProcessWrapper} object.
+   * @throws org.eclipse.steady.python.ProcessWrapperException if any.
+   */
+  public ProcessWrapper setCommand(Path _executable, String... _args)
+      throws ProcessWrapperException {
+    // if(_executable==null || FileUtil.isAccessibleFile(_executable))
+    //	throw new ProcessWrapperException("Illegal executable [" + _executable + "]");
+
+    for (int i = 0; i < _args.length; i++) {
+      final Matcher m = ALLOWED.matcher(_args[i]);
+      if (!m.matches()
+          && !FileUtil.isAccessibleFile(_args[i])
+          && !FileUtil.isAccessibleDirectory(_args[i]))
+        throw new ProcessWrapperException(
+            "Cannot run [" + _executable + "] due to illegal characters in [" + i + ".] argument [" + _args[i] + "], allowed are: a-zA-Z_0-9-.=/");
+    }
+
+    this.exe = _executable;
+    this.args = _args;
+    return this;
+  }
+
+  /**
+   * <p>setPath.</p>
+   *
+   * @param _p a {@link java.nio.file.Path} object.
+   * @return a {@link org.eclipse.steady.python.ProcessWrapper} object.
+   */
+  public ProcessWrapper setPath(Path _p) {
+    this.outPath = _p;
+    return this;
+  }
+
+  /** {@inheritDoc} */
+  @Override
+  public void run() {
+    String name = null;
+    if (FileUtil.isAccessibleFile(this.exe)) name = this.exe.getFileName().toString();
+    else if (this.exe.toString().indexOf(System.getProperty("file.separator")) != -1)
+      name =
+          this.exe
+              .toString()
+              .substring(this.exe.toString().lastIndexOf(System.getProperty("file.separator")) + 1);
+    else name = this.exe.toString();
+    final String rnd = StringUtil.getRandonString(6);
+    final String out_name = name + "-" + this.getId() + "-" + rnd + "-out.txt";
+    final String err_name = name + "-" + this.getId() + "-" + rnd + "-err.txt";
+
+    // Create temp. directory for out and err streams
+    this.outFile = Paths.get(this.outPath.toString(), out_name);
+    this.errFile = Paths.get(this.outPath.toString(), err_name);
+
+    try {
+      final ArrayList<String> cmd = new ArrayList<String>();
+      cmd.add(this.exe.toString());
+      cmd.addAll(Arrays.asList(this.args));
+      final ProcessBuilder pb = new ProcessBuilder(cmd);
+
+      // Redirect out and err
+      pb.redirectOutput(this.outFile.toFile());
+      pb.redirectError(this.errFile.toFile());
+
+      // Start and wait
+      final Process process = pb.start();
+      this.exitCode = process.waitFor();
+
+      if (this.exitCode != 0) {
+        final String error_msg = FileUtil.readFile(this.errFile);
+        log.error("Error running [" + this.getCommand() + "]: " + error_msg);
+      }
+
+    } catch (IOException ioe) {
+      log.error("Error running [" + this.getCommand() + "]: " + ioe.getMessage());
+    } catch (InterruptedException ie) {
+      log.error("Error running [" + this.getCommand() + "]: " + ie.getMessage());
+    }
+  }
+
+  /**
+   * <p>Getter for the field <code>outFile</code>.</p>
+   *
+   * @return a {@link java.nio.file.Path} object.
+   */
+  public Path getOutFile() {
+    return outFile;
+  }
+
+  /**
+   * <p>Getter for the field <code>errFile</code>.</p>
+   *
+   * @return a {@link java.nio.file.Path} object.
+   */
+  public Path getErrFile() {
+    return errFile;
+  }
+
+  /**
+   * <p>Getter for the field <code>exitCode</code>.</p>
+   *
+   * @return a int.
+   */
+  public int getExitCode() {
+    return exitCode;
+  }
+
+  /**
+   * <p>terminatedWithSuccess.</p>
+   *
+   * @return a boolean.
+   */
+  public boolean terminatedWithSuccess() {
+    return this.exitCode == 0;
+  }
+
+  /**
+   * <p>getCommand.</p>
+   *
+   * @return a {@link java.lang.String} object.
+   */
+  public String getCommand() {
+    final ArrayList<String> cmd = new ArrayList<String>();
+    cmd.add(this.exe.toString());
+    cmd.addAll(Arrays.asList(this.args));
+    return StringUtil.join(cmd, " ");
+  }
+}
diff --git a/kb-importer/src/main/java/org/eclipse/steady/kb/exception/ValidationException.java b/shared/src/main/java/org/eclipse/steady/shared/util/ProcessWrapperException.java
old mode 100755
new mode 100644
similarity index 55%
rename from kb-importer/src/main/java/org/eclipse/steady/kb/exception/ValidationException.java
rename to shared/src/main/java/org/eclipse/steady/shared/util/ProcessWrapperException.java
index 543696446..03d1fce24
--- a/kb-importer/src/main/java/org/eclipse/steady/kb/exception/ValidationException.java
+++ b/shared/src/main/java/org/eclipse/steady/shared/util/ProcessWrapperException.java
@@ -16,31 +16,31 @@
  * SPDX-License-Identifier: Apache-2.0
  * SPDX-FileCopyrightText: Copyright (c) 2018-2020 SAP SE or an SAP affiliate company and Eclipse Steady contributors
  */
-package org.eclipse.steady.kb.exception;
+package org.eclipse.steady.shared.util;
 
 /**
- * Validation exception
+ * Thrown to indicate a problem when calling OS-level services.
  */
-public class ValidationException extends Exception {
+public class ProcessWrapperException extends Exception {
 
-  private static final long serialVersionUID = 4113470472092415302L;
+  private static final long serialVersionUID = 1L;
 
   /**
-   * <p>Constructor for ValidationException.</p>
+   * <p>Constructor for ProcessWrapperException.</p>
    *
-   * @param message a {@link java.lang.String} object
+   * @param _message a {@link java.lang.String} object.
    */
-  public ValidationException(String message) {
-    super(message);
+  public ProcessWrapperException(String _message) {
+    super(_message);
   }
 
   /**
-   * <p>Constructor for ValidationException.</p>
+   * <p>Constructor for ProcessWrapperException.</p>
    *
-   * @param message a {@link java.lang.String} object
-   * @param cause a {@link java.lang.Throwable} object
+   * @param _message a {@link java.lang.String} object.
+   * @param _cause a {@link java.lang.Throwable} object.
    */
-  public ValidationException(String message, Throwable cause) {
-    super(message, cause);
+  public ProcessWrapperException(String _message, Throwable _cause) {
+    super(_message, _cause);
   }
 }
diff --git a/shared/src/test/java/org/eclipse/steady/shared/util/FileUtilTest.java b/shared/src/test/java/org/eclipse/steady/shared/util/FileUtilTest.java
index 5c1de0b31..3ef279089 100755
--- a/shared/src/test/java/org/eclipse/steady/shared/util/FileUtilTest.java
+++ b/shared/src/test/java/org/eclipse/steady/shared/util/FileUtilTest.java
@@ -27,6 +27,7 @@
 import java.nio.charset.Charset;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.nio.file.StandardCopyOption;
 import java.util.Set;
 
 import org.eclipse.steady.shared.enums.DigestAlgorithm;
@@ -66,22 +67,6 @@ public void testGetCRC32Bytes() {
     assertEquals(4157704578l, FileUtil.getCRC32("Hello".getBytes()));
   }
 
-  @Test
-  public void testCopyFile() {
-    try {
-      final VulasConfiguration cfg = new VulasConfiguration();
-      final Path tmp_dir = cfg.getTmpDir();
-      final Path source_file = Paths.get("./src/test/resources/Outer.jar");
-      final Path target_file = FileUtil.copyFile(source_file, tmp_dir);
-      assertEquals(
-          FileUtil.getDigest(source_file.toFile(), DigestAlgorithm.SHA1),
-          FileUtil.getDigest(target_file.toFile(), DigestAlgorithm.SHA1));
-    } catch (IOException e) {
-      e.printStackTrace();
-      assertEquals(true, false);
-    }
-  }
-
   @Test
   public void testGetJarFilePathsForResources() {
     final String[] resources = new String[] {"LICENSE-junit.txt"}; // Contained in junit-4.12.jar
@@ -114,4 +99,48 @@ public void testGetFileName() {
         FileUtil.getFileName(Paths.get("./project/js/hello.io.min.js").toString(), false);
     assertEquals("hello.io.min", name3);
   }
+
+  @Test
+  public void testCopy() {
+    try {
+      // Copy file and keep name
+      Path source = Paths.get("./src/test/resources/foo.txt");
+      Path target_dir = Paths.get("./target");
+      Path target_name = null;
+      Path target = FileUtil.copy(source, target_dir, target_name, StandardCopyOption.REPLACE_EXISTING);
+      assertTrue(FileUtil.isAccessibleFile("./target/foo.txt"));
+      assertEquals(
+          FileUtil.getDigest(source.toFile(), DigestAlgorithm.SHA1),
+          FileUtil.getDigest(target.toFile(), DigestAlgorithm.SHA1));
+
+      // Copy file and change name
+      source = Paths.get("./src/test/resources/foo.txt");
+      target_dir = Paths.get("./target");
+      target_name = Paths.get("bar.txt");
+      target = FileUtil.copy(source, target_dir, target_name, StandardCopyOption.REPLACE_EXISTING);
+      assertTrue(FileUtil.isAccessibleFile("./target/bar.txt"));
+      assertEquals(
+          FileUtil.getDigest(source.toFile(), DigestAlgorithm.SHA1),
+          FileUtil.getDigest(target.toFile(), DigestAlgorithm.SHA1));
+
+      // Copy dir and keep name
+      source = Paths.get("./src/test/resources/foo");
+      target_dir = Paths.get("./target");
+      target_name = null;
+      target = FileUtil.copy(source, target_dir, target_name, StandardCopyOption.REPLACE_EXISTING);
+      assertTrue(FileUtil.isAccessibleFile("./target/foo/bar/bar.baz"));
+      assertTrue(FileUtil.isAccessibleDirectory("./target/foo/bar"));
+
+      // Copy dir and change name
+      source = Paths.get("./src/test/resources/foo");
+      target_dir = Paths.get("./target");
+      target_name = Paths.get("baz");
+      target = FileUtil.copy(source, target_dir, target_name, StandardCopyOption.REPLACE_EXISTING);
+      assertTrue(FileUtil.isAccessibleFile("./target/baz/bar/bar.baz"));
+      assertTrue(FileUtil.isAccessibleDirectory("./target/baz/bar"));
+    } catch (IOException e) {
+      e.printStackTrace();
+      assertTrue(false);
+    }
+  }
 }